Initial Decision Release No. 1394

Administrative Proceeding

File No. 3-16386

UNITED STATES OF AMERICA

Before the

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

In the Matter of

Traci J. Anderson, CPA,

Timothy W. Carnahan, and

CYIOS Corporation

Initial Decision

January 10, 2020

Appearances: Matthew J. Gulde, Chris Davis, and B. David Fraser 

for the Division of Enforcement, 

Securities and Exchange Commission

Timothy W. Carnahan, pro se, and for CYIOS Corporation

Before: James E. Grimes, Administrative Law Judge

Summary

This initial decision resolves allegations of material misstatements and 

reporting violations against Respondents Timothy W. Carnahan and CYIOS 

Corporation. CYIOS is a former public company that had a class of securities 

registered with the Securities and Exchange Commission, and Carnahan is its 

sole officer and director. For several years, CYIOS’s public, periodic filings 

misrepresented that the company’s management had assessed the 

effectiveness of its internal controls over financial reporting for each period 

using an established framework. The evidence establishes that CYIOS had no 

documented internal controls and Carnahan did not use any suitable 

framework to assess the company’s internal controls. Indeed, Carnahan 

admitted during his investigative testimony that he was the company’s 

internal control and acted as his own quality assurance. Carnahan caused 

CYIOS’s filings to be made with the Commission and signed multiple 

certifications misrepresenting that the filings contained no untrue statements 
2

of material fact. Additionally, CYIOS failed to make numerous required 

periodic filings while its securities were registered. 

I find that CYIOS violated, and Carnahan caused its violations of, Section 

17(a)(3) of the Securities Act of 1933, Section 13(a) of the Securities Exchange 

Act of 1934, and Exchange Act Rules 13a-1 and 13a-13. I also find that 

Carnahan violated Exchange Act Rules 13a-14 and 13a-15(c). I order 

appropriate sanctions below.1

Procedural Background

The Commission initiated this proceeding in February 2015, when it

issued an order instituting proceedings (OIP) under Securities Act Section 8A, 

Exchange Act Sections 4C and 21C, and Commission Rule of Practice 102(e).2

In relevant part, the OIP alleges the following facts and violations: Carnahan 

failed to assess CYIOS’s internal controls and CYIOS misrepresented in its 

periodic filings that management had assessed its internal controls using the 

criteria set forth in the Internal Control-Integrated Framework issued by the 

Committee of Sponsoring Organizations of the Treadway Commission (COSO 

framework). As a result, CYIOS violated, and Carnahan caused its violations 

of, Securities Act Section 17(a)(3), which makes it unlawful to engage in any 

transaction, practice, or course of business which operates or would operate as 

a fraud or deceit upon the purchaser.3 Also as a result of this misconduct, 

Carnahan violated Exchange Act Rule 13a-14, which requires an issuer’s 

principal executive and principal financial officer to attest that the company’s 

“report does not contain any untrue statement of a material fact”; and 

Exchange Act Rule 13a-15(c), which requires an issuer’s management to 

perform an evaluation of the company’s internal controls as of the end of each 

fiscal year.4 Further, due to its failure to file multiple periodic reports while its 

 

1 A prior initial decision dismissed the proceeding as to Respondent Traci J. 

Anderson, CPA, and that decision has become the final decision of the 

Commission. Traci J. Anderson, CPA, Initial Decision Release No. 930, 2015 

WL 9297356, at *1, *24 (ALJ Dec. 21, 2015), finality order, Securities Act 

Release No. 10032, 2016 SEC LEXIS 380 (Feb. 2, 2016). 

2 See 15 U.S.C. §§ 77h-1, 78d-3, 78u-3; 17 C.F.R. § 201.102(e).

3 15 U.S.C. § 77q(a)(3).

4 17 C.F.R. §§ 240.13a-14, .13a-15(c).
3

securities were registered, CYIOS violated, and Carnahan caused its violations 

of, Exchange Act Section 13(a) and Rules 13a-1 and 13a-13.5

In 2015, an administrative law judge held a hearing and issued an initial 

decision in which he found against Respondents on these charges but 

dismissed two other charges that the Division is no longer pursuing.6

Respondents appealed to the Commission.

In August 2018, following the Supreme Court’s decision in Lucia v. SEC, 

the Commission remanded this proceeding, ordered that it be reassigned to an 

administrative law judge who had not previously participated in the matter,

and directed that Respondents be given the opportunity for a new hearing.7 On 

remand, the newly assigned administrative law judge ordered the parties to 

submit a proposal for the conduct of further proceedings.

8 In November 2018, 

the parties represented that they were unable to agree to a proposal and

Respondents sought dismissal.

This case was reassigned to me in March 2019.9 Following a prehearing 

conference, I adopted the parties’ jointly proposed schedule with modest 

amendments.10 In late April 2019, I denied in part and deferred ruling in part 

on Respondents’ motion for a ruling on the pleadings.

11 In doing so, I directed 

the Division to submit supplemental briefing on whether, following remand, 

charges under Section 105(c)(7)(B) of the Sarbanes-Oxley Act of 2002 and 

 

5 15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13.

6 Anderson, 2015 WL 9297356, at *1, *9–20; see also Anderson, Admin. Proc. 

Rulings Release No. 6549, 2019 SEC LEXIS 961, at *15–16 (ALJ Apr. 24, 

2019); Anderson, Admin. Proc. Rulings Release No. 6613, 2019 SEC LEXIS 

1482, at *2–3 (ALJ June 24, 2019).

7 Pending Admin. Proc., Securities Act Release No. 10536, 2018 WL 

4003609, at *1 (Aug. 22, 2018); see also Lucia v. SEC, 138 S. Ct. 2044 (2018).

8 Anderson, Admin. Proc. Rulings Release No. 6126, 2018 SEC LEXIS 2705, 

at *2 (ALJ Oct. 1, 2018).

9 Anderson, Admin. Proc. Rulings Release No. 6474, 2019 SEC LEXIS 295 

(ALJ Mar. 4, 2019).

10 Anderson, Admin. Proc. Rulings Release No. 6519, 2019 SEC LEXIS 632

(ALJ Mar. 26, 2019).

11 Anderson, 2019 SEC LEXIS 961.
4

Securities Act Section 17(a)(2) were still at issue.12 The Division responded 

that it would not pursue “these charges further and w[ould] not offer evidence 

supporting them.”13

In July, I ruled on various motions and denied Respondents’ motions 

seeking dismissal.14

I held the hearing in this matter in July 2019. During the hearing, the 

Division called three witnesses, Carnahan rested without calling any 

witnesses or offering any exhibits, and I admitted 23 of the Division’s offered 

exhibits. Carnahan refused to testify on Fifth Amendment grounds and I 

instructed the Division to file a motion regarding whether I should draw 

adverse inferences from Carnahan’s refusal to testify.15 I gave Respondents ten 

days to respond to the Division’s motion.16 After the Division briefed the issue 

but Carnahan failed to respond, I determined that I would draw adverse 

inferences from Carnahan’s silence subject to the Division identifying specific 

questions and inferences in its post-hearing brief.17 I also admitted four 

exhibits that the Division was prevented from introducing through Carnahan’s 

testimony by his refusal to testify.18

The Division filed its post-hearing brief in September 2019. Respondents 

have made no filings since the hearing. 

 

12 See id. at *11–16.

13 Div. Supplemental Br. 1–2 (Apr. 30, 2019).

14 See, e.g., Anderson, Admin. Proc. Rulings Release No. 6620, 2019 SEC 

LEXIS 1622 (ALJ July 2, 2019); Anderson, Admin. Proc. Rulings Release No.

6626, 2019 SEC LEXIS 1724 (ALJ July 11, 2019).

15 Anderson, Admin. Proc. Rulings Release No. 6632, 2019 SEC LEXIS 1782 

(ALJ July 18, 2019). 

16 Id.

17 Anderson, Admin. Proc. Rulings Release No. 6650, 2019 SEC LEXIS 1955 

(ALJ Aug. 5, 2019). 

18 Id. at *8. 
5

Procedural Issues

I base the following factual findings and legal conclusions on the entire 

record and on facts officially noticed, applying preponderance of the evidence 

as the standard of proof.19 I have given no weight to and have not presumed 

the correctness of any opinions, orders, or rulings issued in this matter prior 

to the Commission’s post-Lucia remand order of August 22, 2018.

20 All 

arguments that are inconsistent with this decision are rejected.

At the July hearing, I reserved ruling on the admissibility of Exhibit 43, 

which contained Carnahan’s testimony from the pre-Lucia hearing held in 

2015. The 2015 hearing was presided over by a judge who, at the time of the 

hearing, was not properly appointed.

21 Admission of the prior hearing 

testimony would arguably contravene the Commission’s post-Lucia directive 

to provide respondents with the opportunity for a new hearing before a judge 

who did not previously participate in the matter, unless the parties expressly 

agreed otherwise.22 Carnahan exercised his right to a new hearing but then 

refused to testify. Nonetheless, the prior testimony is unnecessary given the 

record developed at the July hearing, and the Division does not rely on it or 

make any argument regarding its admissibility in its brief. I now determine 

that Exhibit 43 is not admitted.23

During the hearing, Carnahan appeared to object to the entire 

administrative proceeding on statute of limitations grounds. I instructed 

Carnahan that he could address this argument in his post-hearing brief, but 

he did not do so.

24 Carnahan’s argument seeking dismissal on this basis has 

 

19 See Rita J. McConville, Exchange Act Release No. 51950, 2005 WL 

1560276, at *14 (June 30, 2005), pet. denied, 465 F.3d 780 (7th Cir. 2006); see 

also 17 C.F.R. § 201.323; Anderson, Admin. Proc. Rulings Release No. 6622, 

2019 SEC LEXIS 1706, at *1 (ALJ July 10, 2019) (taking official notice under 

Rule 323 of CYIOS’s public filings with the Commission and their content). 

20 See Pending Admin. Proc., 2018 WL 4003609, at *1.

21 Tr. 17; see also Lucia, 138 S. Ct. at 2055.

22 Pending Admin. Proc., 2018 WL 4003609, at *1.

23 17 C.F.R. §§ 201.111(c), .320(a).

24 Tr. 138–40.
6

previously been denied.25 The OIP was filed on February 13, 2015, and the 

relevant misconduct began with CYIOS’s 2009 Form 10-K filed on February 

26, 2010, which is within the five-year limitations period in 28 U.S.C. § 2462.

26

Regarding adverse inferences, the Division summarily referenced the 

topics about which Carnahan refused to testify in its brief, without identifying 

“the specific questions and inferences it seeks,” as I directed it to do.27 In any 

event, the record provides sufficient proof of Respondents’ violations, without 

regard to any adverse inference.28 It is therefore unnecessary to base my 

findings and conclusions on adverse inferences drawn from Carnahan’s refusal 

to testify.29

Findings of Fact

1. Relevant Persons and Entities

CYIOS is incorporated in Nevada and headquartered in Washington, 

D.C.30 CYIOS operates two subsidiaries that provide technology services and 

products to U.S. government entities.31 One of CYIOS’s subsidiaries offers a 

product called CYIPRO, which is described as “a business transformation tool” 

that was built “to complement knowledge management and business 

 

25 See Anderson, Admin. Proc. Rulings Release No. 6223, 2018 SEC LEXIS 

2894, at *7 (ALJ Oct. 18, 2018); Anderson, Admin. Proc. Rulings Release No.

6620, 2019 SEC LEXIS 1622 (ALJ July 2, 2019).

26 OIP ¶¶ 11, 16, 20; CYIOS Corp., Annual Report (Form 10-K) (Feb. 26, 

2010); see also Gabelli v. SEC, 568 U.S. 442, 447–48 (2013).

27 Anderson, 2019 SEC LEXIS 1955, at *8.

28 I did rely on adverse inferences to admit four of the Division’s exhibits 

after the hearing. See supra note 18 and accompanying text.

29 See Guy P. Riordan, Securities Act Release No. 9085, 2009 WL 4731397, 

at *16 (Dec. 11, 2009) (concluding that the evidence against the respondent 

was “persuasive and more than sufficient to support findings of violations, 

without regard to any adverse inference”), pet. denied, 627 F.3d 1230 (D.C. Cir. 

2010), abrogated on other grounds by Kokesh v. SEC, 137 S. Ct. 1635 (2017).

30 Div. Ex. 21 at 490. Citations to an exhibit’s Bates numbers are to the 

numerical digits only, excluding any alphabetical prefix and leading zeros.

31 Id. at 500. 
7

transformation for agencies and commercial business.”32 This product 

“provides a virtual work space for collaboration, project management, and 

document management to help manage people, processes and information.”33

CYIOS has represented in its public filings that CYIPRO “provides key 

solutions for compliance with Securities and Exchange Commission (‘SEC’) 

Sarbanes-Oxley regulations,” but it is unclear how this aspect of the product 

functioned or what regulations it addressed.34

Carnahan earned a bachelor of science degree in computer science from 

Old Dominion University in 1989.35 He has no formal education in accounting 

or financial statement preparation.36 After college graduation, Carnahan 

worked for the U.S. Senate Sergeant at Arms where he “ran all the computer 

systems for every Senator.”

37 Carnahan founded CYIOS in 1995 and took the 

company public through a reverse merger in 2005.38 Since the merger, he has 

served as the company’s CEO, treasurer, and board chairman; and, since July 

2007, he has served as its sole officer and director.39 He signed company filings 

as its CEO, president, principal financial officer, and principal accounting 

officer.40

After serving as the company’s independent auditor for several years, 

Traci J. Anderson resigned as its auditor and performed full-time accountingrelated work for CYIOS from at least 2010 until 2015.41 She interacted directly 

with Carnahan and saw how the company functioned.42

 

32 Id.

33 Div. Ex. 3 at 100. 

34 See id.

35 Div. Ex. 12 at 281; Div. Ex. 2 at 16. 

36 Div. Ex. 2 at 16–18. 

37 Id. at 18–19. 

38 Id. at 20; Div. Ex. 3 at 100. 

39 Div. Ex. 2 at 20–21. 

40 Div. Ex. 2 at 67.

41 Tr. 33–34, 64–65; Div. Ex. 2 at 33–34, 83–84, 88–89. 

42 Tr. 37.
8

2. Delinquent Filings, Misstatements as to Internal Controls, and Stock 

Issued in Exchange for Consulting Services

CYIOS was a public company with its common stock registered with the 

Commission under Exchange Act Section 12(g).43 CYIOS’s last periodic filing 

was an amended Form 10-Q for the third quarter of 2012, which was filed 

November 21, 2012.44 CYIOS filed a Form 15-12G to terminate its common 

stock’s registration on May 30, 2014, which became effective ninety days later 

on August 28, 2014.45

Carnahan was responsible for CYIOS’s periodic filings with the 

Commission and their content, filed them with the Commission through its 

electronic filing system, drafted responses to Commission staff’s comment 

letters regarding the filings, and knew CYIOS had failed to make required 

public filings between November 2012 and May 2014.46 Due to a downturn in 

the company’s financial condition, Carnahan decided to stop making CYIOS’s 

required periodic filings, prioritizing other bills instead of paying fees 

necessary to complete the filings.47

In its Forms 10-K for the fiscal years 2009, 2010, and 2011, as well as in 

its Forms 10-Q covering first quarter 2010 through third quarter 2012, CYIOS 

represented that management had: (1) assessed the effectiveness of its internal 

controls using the criteria set forth in the COSO framework, and (2) concluded 

that its internal controls were effective.

48 Attached to the reports were 

Carnahan’s certifications under Exchange Act Rule 13a-14 that the reports did 

not contain any untrue statements of material fact.49

 

43 See 15 U.S.C. § 78l(g); Div. Ex. 44; see, e.g., Div. Ex. 3 at 99. 

44 CYIOS Corp., Amended Quarterly Report (Form 10-Q/A) (Nov. 21, 2012); 

Div. Ex. 21.

45 CYIOS Corp., Certification and Notice of Termination of Registration 

(Form 15) (May 30, 2014); Div. Ex. 44; see also 17 C.F.R. § 240.12g-4(a). 

46 Tr. 40–42, 56–58; Div. Ex. 2 at 40, 58–60. 

47 Div. Ex. 2 at 40–41; Tr. 56–57; Answer (filed Mar. 9, 2015) at 4. 

48 Official Notice; see, e.g., Div. Ex. 3 at 118; Div. Ex. 11 at 248; Div. Ex. 12 

at 281; Div. Ex. 13 at 309–10; Div. Ex. 21 at 505. 

49 Official Notice; see, e.g., Div. Ex. 3 at 124; Div. Ex. 12 at 286; Div. Ex. 21 

at 513–14.
9

When asked during his investigative testimony, however, Carnahan could 

not explain how he evaluated the effectiveness of CYIOS’s internal controls.

He testified that: he kept track of the company’s revenue and payroll himself; 

because he wrote the payroll system, “it can’t be flawed”; and he was the 

company’s “internal control” and “did the internal controls” in his “mind,” so 

he could not document himself.50 This testimony—which Carnahan did not 

dispute, disavow, or attempt to explain during the hearing—established that 

the periodic filings were the only documentation of CYIOS’s internal controls

and, as the company’s sole director and officer serving in every relevant role, 

he was his “own quality assurance.”51 Carnahan also stated that he has had 

“several arguments” with attorneys, auditors, and Anderson about accounting 

principles related to revenue recognition, but that he makes all the decisions 

on when revenue is recognized and he decides all the accounting policies.52

Although Anderson helped prepare the company’s financial statements, 

Carnahan was responsible for incorporating them in the periodic filings, and 

he fully controlled and was solely responsible for evaluating the company’s 

internal controls.

53 Anderson was familiar with the COSO framework from her 

continuing education studies but was unaware of anything specifically done by 

Carnahan to evaluate internal controls using the COSO framework.54

Carnahan did not perform formal risk assessments as part of maintaining 

internal controls at CYIOS and, aside from checklists from auditors, had no 

formally documented accounting policies or procedures for the company.55

Anderson believed that the company’s financial information “was eventually 

reported ... the correct way” but only after Carnahan had many disagreements 

with others as he “would prefer it to be done his way.”56

 

50 Div. Ex. 2 at 63–65, 72–73. 

51 Id. at 63, 66–69, 72–73, 75. 

52 Id. at 42–46.

53 Tr. 44–46, 53–55; Div. Ex. 38.

54 Tr. 45–46.

55 Tr. 46–47.

56 Tr. 48–49.
10

Carnahan has represented that the company’s internal controls were 

assessed using CYIPRO,57 but no evidence supports this claim.

In March and October 2010, CYIOS issued common shares of its registered 

securities, with a total value of $37,500, as stock compensation in exchange for 

consulting services.58 This occurred during the time when the company’s 

periodic filings contained the misstatements about Carnahan’s assessment of 

the company’s internal controls. 

3. Expert evidence 

The Division introduced expert evidence from Charles R. Lundelius Jr., 

CPA.59 Lundelius earned a bachelor of science in commerce with a major in 

accounting from the University of Virginia in 1978 and a master’s in business 

administration with a concentration in finance from Tulane University in 

1980.60 Early in his career, he worked as an investment banker and ran a 

broker-dealer.61 Lundelius was the senior vice president and chief financial 

officer of a leading marketer of long-term insurance and its affiliate from 1989 

to 1992, and also served as chief investment officer.62 He worked as a forensic 

accountant at Coopers & Lybrand, Deloitte, and FTI Consulting, Inc., between 

1992 and 2012.63 Lundelius also served on the NASDAQ Listing Qualifications 

Panel from 1999 to 2006.64 Since 2012, he has been the managing director of 

the capital markets group at Berkeley Research Group, LLC.65 Lundelius 

authored Financial Reporting Fraud: A Practical Guide to Detection and 

Internal Control, a textbook published by the American Institute of Certified 

Public Accountants.66 He has testified as an expert in more than fifty cases 

 

57 Div. Ex. 22 at 5; Div. Ex. 40.

58 Div. Ex. 12 at 274, 277.

59 Tr. 102, 133; see generally Div. Ex. 42.

60 Div. Ex. 42, App. A at 29. 

61 Tr. 108.

62 Div. Ex. 42 at 1 & n.1; Tr. 106.

63 Div. Ex. 42 at 1. 

64 Id.

65 Id.

66 Id. at 2.
11

over the past twenty-five years and has participated in numerous 

investigations relating to internal controls and corporate governance.67

Lundelius’s expert report, which comprised the bulk of his direct 

testimony, offered three main opinions: (1) disclosures indicating whether or 

not an issuer has implemented effective internal controls are material; 

(2) disclosures indicating whether or not an issuer has implemented “a 

suitable, recognized control framework that is established by a body or group 

that has followed due-process procedures, including the broad distribution of 

the framework for public comment,” are material; and (3) CYIOS’s failure to 

assess the effectiveness of its internal controls using the COSO framework, as 

stated in its filings, made those statements material misrepresentations.68

Lundelius also opined on related issues. He testified that suitable, 

recognized frameworks for evaluating issuers’ internal controls, such as COSO, 

are frameworks that were publicly circulated and presented for comment from 

the accounting profession.69 Lundelius also gave his opinion that CYIOS’s 

CYIPRO product was not a suitable, recognized framework for evaluating 

internal controls.

70 He elaborated on the five components of COSO and gave 

his opinion on how Carnahan’s internal controls assessment of CYIOS did not 

appear to appropriately address any of those elements.71

Carnahan did not move to exclude Lundelius’s testimony, challenge his 

expertise, or present contrary evidence. Although he objected when the 

Division elicited testimony to correct an error in Lundelius’s report, I overruled 

Carnahan’s objection.72 Carnahan did little on cross-examination to discredit 

Lundelius’s testimony, choosing to chiefly focus on whether Lundelius had 

 

67 Id. at 1 & App. A at 1. 

68 Id. at 3, 7–12. As discussed further in my legal conclusions, Exchange Act 

Rule 13a-15(c) contains an explicit requirement that management’s evaluation 

of the issuer’s internal controls must be based on a suitable, recognized control 

framework.

69 Tr. 110–12; see also Div. Ex. 42 at 4, 7–8. 

70 Tr. 113–14; see also Div. Ex. 42 at 8–9.

71 Tr. 121–24; see also Div. Ex. 42 at 5–6.

72 Tr. 104–05.
12

reviewed CYIOS’s patent.73 Carnahan, however, failed to present any evidence 

about CYIOS’s patent or whether it had one.

74

Conclusions of Law

1. Carnahan caused CYIOS’s violation of Securities Act Section 17(a)(3).

The Division charged CYIOS with violating Securities Act Section 

17(a)(3), and Carnahan with causing that violation. Section 17(a)(3) makes it 

“unlawful for any person in the offer or sale of any securities,” by use of 

interstate means or the mails, “to engage in any transaction, practice, or course 

of business which operates or would operate as a fraud or deceit upon the 

purchaser.”75 Repeatedly making or disseminating material misstatements

may constitute a fraudulent practice or course of business under Section 

17(a)(3).

76 The Division need not demonstrate scienter to establish a violation 

 

73 Tr. 125–26. 

74 When he cross-examined Lundelius, Carnahan asked Lundelius whether 

he evaluated CYIOS’s patent and asserted that “the patent is in the 10-Ks” 

CYIOS filed. Tr. 125–29. But CYIOS’s Forms 10-K do not establish the 

existence of a patent; they represent merely that one of CYIOS’s subsidiaries 

had applied for registration of CYIPRO’s logo with the U.S. Patent and 

Trademark Office, and that CYIOS claims copyright protection for CYIPRO. 

See, e.g., Div. Ex. 3 at 102. Moreover, Carnahan’s questions and statements 

during cross-examination, as opposed to sworn testimony on the witness stand, 

are not evidence. Sims v. Greene, 161 F.2d 87, 88 (3d Cir. 1947).

75 15 U.S.C. § 77q(a)(3). 

76 See Dennis J. Malouf, Securities Act Release No. 10115, 2016 WL 

4035575, at *12 (July 27, 2016), aff’d, 933 F.3d 1248 (10th Cir. 2019). The 

Tenth Circuit held in Malouf that liability for misconduct involving material 

misstatements may lie under Securities Act Section 17(a)(3) given the 

Supreme Court’s interpretation of similar language under Exchange Act Rule 

10b-5(c) in Lorenzo v. SEC, 139 S. Ct. 1094 (2019). See 933 F.3d at 1259–60; 

see also Lorenzo, 139 S. Ct. at 1101 (“By sending emails he understood to 

contain material untruths, Lorenzo . . . ‘engage[d] in a[n] act, practice, or 

course of business’ that ‘operate[d] . . . as a fraud or deceit’ under subsection 

(c) of the Rule.” (alterations in original)).
13

of Section 17(a)(3); negligence is sufficient to establish a violation of Section 

17(a)(3).

77

A misstatement is material if there is a substantial likelihood that a 

reasonable investor would view “disclosure of the omitted fact ... as having 

significantly altered the ‘total mix’ of information made available.”78

Misconduct occurs “in the offer or sale” of securities when, for instance, 

misstatements are material and are contained in documents on which an 

investor would presumably rely, such as public filings made with the

Commission, at the time when the issuer offered or sold its securities.

79 The 

interstate commerce requirement is satisfied when the misstatements are 

contained in filings made with the Commission via EDGAR, a system 

maintained by the Commission for the electronic filing of documents.

80

To establish Carnahan’s liability for causing CYIOS’s violation of Section 

17(a)(3), the Division must show: (1) a primary violation; (2) an act or omission 

by Carnahan that caused the violation; and (3) that Carnahan knew, or should 

have known, that his conduct would contribute to the violation.81 Negligence is 

 

77 See Aaron v. SEC, 446 U.S. 680, 701–02 (1980); Malouf, 2016 WL 4035575, 

at *11 n.74.

78 Matrixx Initiatives, Inc. v. Siracusano, 563 U.S. 27, 38 (2011) (quoting

Basic Inc. v. Levinson, 485 U.S. 224, 231–32 (1988)). 

79 See, e.g., SEC v. Wolfson, 539 F.3d 1249, 1262–63 (10th Cir. 2008); cf.

United States v. Naftalin, 441 U.S. 768, 773 (1979) (explaining that “Congress 

expressly intended to define broadly” language in Section 17(a) that the fraud 

occur in the offer or sale of any securities). 

80 See SEC v. Straub, No. 11-cv-9645, 2016 WL 5793398, at *11 (S.D.N.Y. 

Sep. 30, 2016) (“a company uses an instrumentality of interstate commerce 

when it files documents publicly on the EDGAR website”); Anthony Fields, 

CPA, Securities Act Release No. 9727, 2015 WL 728005, at *6 & n.17 (Feb. 20, 

2015) (“use of the Internet ... is per se sufficient to satisfy the interstate 

jurisdictional element of the securities laws”); McConville, 2005 WL 1560276, 

at *10 (“misstatements and omissions in ... financial statements ... 

electronic[ally] fil[ed]” with the Commission meet interstate commerce 

requirement).

81 Robert M. Fuller, Securities Act Release No. 8273, 2003 WL 22016309, at 

*4 (Aug. 25, 2003), pet. denied, 95 F. App’x 361 (D.C. Cir. 2004).
14

enough to demonstrate causing liability if the primary violation does not 

require a showing of scienter.82

CYIOS’s statements that management had evaluated the company’s 

internal controls using the COSO framework were false. Carnahan’s

undisputed investigative testimony established that he was the only so-called

“internal control” and the statements in the periodic filings were the only 

support for his assessment of the company’s internal controls.

83 CYIOS 

employed no process meeting the COSO framework.84 CYIOS’s misstatements 

were made in multiple periodic reports uploaded to the Commission’s EDGAR 

database for the investing public to see and rely upon. Further, CYIOS 

obtained consulting services in exchange for its publicly traded stock while 

these misstatements were in its periodic reports. 

As to materiality, CYIOS was legally required to report on its internal 

controls in its filings and to include management’s annual report on internal 

controls that contained, among other items, a “statement identifying the 

framework used by management to evaluate the effectiveness of” its internal 

controls.

85 By Commission regulation, internal controls must be assessed using 

a suitable, recognized framework that meets certain standards.

86 When 

disclosures are required by law, those disclosures are presumed material.87

That presumption is justified with respect to disclosures about internal 

 

82 KPMG Peat Marwick LLP, Exchange Act Release No. 43862, 2001 WL 

47245, at *19 (Jan. 19, 2001), recons. denied, Exchange Act Release No. 44050, 

2001 WL 223378 (Mar. 8, 2001), pet. denied, 289 F.3d 109 (D.C. Cir. 2002).

83 Div. Ex. 2 at 63–69, 72–73, 75.

84 Tr. 45–47, 113–14, 121–24; see also Div. Ex. 42 at 5–6, 8–12; see generally

COSO Internal Control – Integrated Framework – 1992 and 1994, CCH

Accounting Research Manager (Wolters Kluwer).

85 See 17 C.F.R. §§ 229.308(a) (requiring companies to disclose information 

regarding its internal controls in Forms 10-K), .601(b)(31)(i) (requiring 

management certification regarding internal controls as an exhibit to a 

periodic report).

86 See 17 C.F.R. § 240.13a-15(c); see infra discussion on Rule 13a-15(c) 

accompanying notes 103–06.

87 See Craftmatic Sec. Litig. v. Krafstow, 890 F.2d 628, 641 n.17 (3d Cir. 

1989); cf. United States v. Bilzerian, 926 F.2d 1285, 1298 (2d Cir. 1991) (“[T]he 

fact that the information is required to be revealed under § 13(d) is evidence of 

its materiality.”). 
15

controls because internal controls provide assurance that an issuer’s financial 

statements—the heart of a public company’s periodic reports—are reliable and 

comply with applicable standards.88 And it is further supported in this case 

because CYIOS was a federal contractor and a false disclosure of this nature 

could threaten its business—as the company recognized in its periodic reports, 

“failure to comply with applicable laws or regulations could have a material 

adverse effect on [its] business and reputation” with the government.89

Moreover, the stark difference between the representations that

Carnahan repeatedly included in multiple reports and his failure to use any 

suitable framework leads to the inescapable conclusion that he knew that the 

representations regarding internal controls were false. In other words, he 

made the false statements with scienter, “a mental state embracing intent to 

deceive, manipulate, or defraud.”90 These knowingly false statements impugn 

 

88 See In re Insys Therapeutics, Inc. Sec. Litig., No. 17-cv-1954, 2018 WL 

2943746, at *5 (S.D.N.Y. June 12, 2018) (“When assurance that a company 

complies with its accounting policies, or that a company has effective internal 

controls, turns out to be false, that would be viewed by the reasonable investor 

as having significantly altered the total mix of information made available.” 

(internal quotation marks omitted)); In re Equimed, Inc., No. 98-cv-5374, 2000 

WL 562909, at *7 (E.D. Pa. May 9, 2000) (“The adequacy of internal controls 

would be material to a shareholder’s decision to buy and sell.”); see also In re 

Grupo Televisa Sec. Litig., 368 F. Supp. 3d 711, 720–21 (S.D.N.Y. 2019) 

(“Misstatements made in [an issuer’s] certifications concerning the design and 

efficacy of internal controls are actionable.”); accord Div. Ex. 42 at 7, 8 

(Lundelius opined that “the lack of effectiveness of internal controls calls into 

question the accuracy of an issuer’s public disclosures” and “a reasonable 

investor would consider the lack of a suitable, recognized framework for 

internal control important when making investment decisions”).

89 See, e.g., Div. Ex. 12 at 262–63.

90 Aaron, 446 U.S. at 686 n.5 (quoting Ernst & Ernst v. Hochfelder, 425 U.S. 

185, 194 n.12 (1976)); see also Ades v. Deloitte & Touche, 799 F. Supp. 1493, 

1499 (S.D.N.Y. 1992) (“An inference of recklessness satisfying the scienter 

requirement may be drawn from facts demonstrating conduct that the 

defendant disseminated material knowing it was false . . . .” (internal 

quotation marks and brackets omitted)). Because Carnahan’s scienter is 

imputed to CYIOS, CYIOS acted with scienter. Clarke T. Blizzard, Advisers 

Act Release No. 2253, 2004 WL 1416184, at *5 (June 23, 2004) (“A company’s 

scienter may be imputed from that of the individuals who control it.”).

Although scienter is not required for a Section 17(a)(3) violation, it is 

nonetheless relevant because evidence sufficient to establish scienter 
16

CYIOS’s management’s integrity, which further supports the determination 

that they are material.91 As reasonable investors would consider the integrity 

of a public company’s management important, outright false statements 

included in periodic filings by management indicate a lack of reliability and 

would affect investors’ decisions regarding that company’s securities.92

The false statements about CYIOS’s internal controls were material. 

CYIOS violated Section 17(a)(3) through its repeated material misstatements 

in its periodic filings. As the person responsible for those filings and their 

content, Carnahan caused CYIOS’s violation.93

2. Carnahan caused CYIOS’s violations of Exchange Act Section 13(a) and 

Rules 13a-1 and 13a-13.

The Division charged CYIOS with violating Exchange Act Section 13(a)

and Exchange Act Rules 13a-1 and 13a-13. Carnahan is charged with causing 

those violations. Exchange Act Section 13(a) and Rules 13a-1 and 13a-13 

require issuers of securities registered under Section 12 to file annual and 

quarterly reports with the Commission.94 Compliance with these requirements 

is mandatory.95 Scienter is not required to establish violations of these 

provisions.

96 As CYIOS’s sole officer and director, Carnahan was responsible 

 

necessarily establishes a lesser mental state. The existence of scienter is also 

relevant to sanctions.

91 See United States v. Hatfield, 724 F. Supp. 2d 321, 328 (E.D.N.Y. 2010); 

In re Monster Worldwide, Inc. Sec. Litig., 251 F.R.D. 132, 139 (S.D.N.Y. 2008).

92 Cf. S.W. Hatfield, CPA, Exchange Act Release No. 73763, 2014 WL 

6850921, at *6 (Dec. 5, 2014) (holding that a “misrepresentation that audit 

reports appearing in ... periodic reports filed with the Commission have been 

signed by a CPA is material”).

93 See Fuller, 2003 WL 22016309, at *4.

94 15 U.S.C. § 78m(a); 17 C.F.R. §§ 240.13a-1, .13a-13.

95 Am.’s Sports Voice, Inc., Exchange Act Release No. 55511, 2007 WL 

858747, at *4 (Mar. 22, 2007), recons. denied, Exchange Act Release No. 55867, 

2007 WL 1624611 (June 6, 2007). 

96 See SEC v. McNulty, 137 F.3d 732, 740–41 (2d Cir. 1998); SEC v. Wills, 

472 F. Supp. 1250, 1268 (D.D.C. 1978). 
17

for the content of the periodic filings and filed them with the Commission via 

EDGAR.

97

As noted above, CYIOS had a class of securities registered under 

Exchange Act Section 12 and did not file any periodic reports between 

November 21, 2012, and May 30, 2014, the date it filed the Form 15 to 

terminate its registration. By failing to make required periodic filings during 

that time, CYIOS violated Exchange Act Section 13(a) and Rules 13a-1 and 

13a-13. Given that Carnahan was responsible for CYIOS’s periodic filings as 

the company’s sole officer and director, he caused these violations.98 In fact, as 

I found above, Carnahan decided to stop making the filings.

3. Carnahan violated Exchange Act Rule 13a-14.

The Division charged Carnahan with violating Exchange Act Rule 13a-14,

which requires that an issuer’s periodic reports, including those filed on Forms 

10-K and 10-Q, include certifications by the issuer’s principal executive and 

principal financial officers, as specified in the filing requirements of such 

reports.

99 Carnahan, who served in these officer roles for CYIOS, was required 

to certify in an exhibit to each periodic report that, based on his knowledge,

the report “does not contain any untrue statement of material fact.”100 And a 

person who makes this certification violates Rule 13a-14 if the periodic report

subject to the certification contains materially false statements.

101 For 

purposes of this decision, I assume that to establish a violation of Rule 13a-14, 

the Division must show that a respondent knew his certification was false or 

acted recklessly in making a false certification.

102

 

97 Div. Ex. 2 at 58–60; Tr. 40–42. 

98 See Gateway Int’l Holdings, Inc., Exchange Act Release No. 53907, 2006 

WL 1506286, at *8 (May 31, 2006); Phlo Corp., Exchange Act Release 

No. 55562, 2007 WL 966943, at *11 & n.66 (Mar. 30, 2007). As explained above, 

CYIOS violated Section 13(a), Carnahan did not make the periodic filings for 

which he was responsible, and he knew or should have known that if he did 

not make those filings, CYIOS would fail to file its periodic reports.

99 17 C.F.R. § 240.13a-14(a). 

100 17 C.F.R. § 229.601(b)(31)(i).

101 See SEC v. Jensen, 835 F.3d 1100, 1112–13 (9th Cir. 2016).

102 See id. at 1113 n.6 (declining to reach the question of the mental state 

required for a violation of Rule 13a-14); id. at 1118 (Bea, J. concurring) (“I 

would hold that liability for false certification under Rule 13a-14 may lie only 
18

CYIOS’s Forms 10-K for fiscal years 2009, 2010, and 2011 and Forms 10-

Q for the first quarter of 2010 through the third quarter of 2012 all falsely 

indicated that management had assessed the company’s internal controls

using the COSO framework. Nevertheless, Carnahan signed certifications 

attached as exhibits to those periodic reports stating there were no untrue 

statements of material fact in the reports. As the reports contained materially 

false statements, Carnahan violated Exchange Act Rule 13a-14. Being the only 

control person of the company, Carnahan knew that no one had assessed 

CYIOS’s internal controls using the COSO framework. 

4. Carnahan violated Exchange Act Rule 13a-15(c).

The Division charged Carnahan with violating Exchange Act Rule 13a15(c), which requires a public company’s management to evaluate the 

effectiveness of the company’s internal controls at each fiscal year’s end.103 The 

rule requires that “[t]he framework on which management’s evaluation of the 

issuer’s internal control over financial reporting is based must be a suitable, 

recognized control framework that is established by a body or group that has 

followed due-process procedures, including the broad distribution of the 

framework for public comment.”

104 It also states that “[a]lthough there are 

many different ways to conduct an evaluation of” internal controls, “an 

evaluation that is conducted in accordance with the interpretive guidance 

issued by the Commission in Release No. 34-55929 will satisfy the evaluation 

required by this paragraph.”105 Commission Release No. 34-55929 cites the 

COSO framework as a suitable control framework and further makes clear 

that management must maintain sufficient evidential matter to support its 

assessment.106

Carnahan was the only member of CYIOS’s management during the 

relevant time period. The evidence establishes that Carnahan did not assess 

 

where a CEO or CFO acts with knowledge or at least recklessness as to the 

falsity of a certification.”).

103 17 C.F.R. § 240.13a-15(c).

104 Id.

105 Id.

106 See Commission Guidance Regarding Management’s Report on Internal 

Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities 

Exchange Act of 1934, 72 Fed. Reg. 35,324, 35,326 nn.23 & 24, 35,329, 35,332

(June 27, 2007).
19

CYIOS’s internal controls using any suitable framework, let alone the COSO 

framework, as the periodic reports claimed.107 Carnahan was aware of the 

statements in CYIOS’s periodic filings and indeed was responsible for those 

filings and their content.

108 Accordingly, Carnahan violated Rule 13a-15(c). 

Sanctions

1. Cease-and-Desist Order

Securities Act Section 8A and Exchange Act Section 21C authorize the 

Commission to issue a cease-and-desist order against any person found to have 

violated, or caused a violation of, a provision of those acts or a rule or regulation 

promulgated under either act.109 To issue such an order, “there must be some 

likelihood of future violations.”110 But the “risk” of future violations “need not 

be very great to warrant issuing a cease-and-desist order. Absent evidence to 

the contrary, a finding of violation raises a sufficient risk of future violation.”111

Additionally, the Commission considers the public-interest factors 

described in Steadman v. SEC112 when determining whether to issue a ceaseand-desist order.113 These factors include: the egregiousness of the 

respondents’ actions, the isolated or recurrent nature of the infraction, the 

degree of scienter involved, the sincerity of the respondents’ assurances 

against future violations, the respondents’ recognition of the wrongful nature 

of their conduct, and the likelihood that the respondents’ occupations will 

present opportunities for future violations.114 The Commission also considers 

 

107 See supra notes 83 and 84 and accompanying text.

108 See supra notes 46, 90, and 91 and accompanying text.

109 See 15 U.S.C. §§ 77h-1(a), 78u-3(a). 

110 KPMG Peat Marwick, 2001 WL 47245, at *24.

111 Id.; see also id. at *26.

112 603 F.2d 1126, 1140 (5th. Cir. 1979), aff’d on other grounds, 450 U.S. 91 

(1981).

113 KPMG Peat Marwick, 2001 WL 47245, at *23 & n.114, *26; see Timothy S. 

Dembski, Securities Act Release No. 10326, 2017 WL 1103685, at *14 (Mar. 24, 

2017), pet. denied, 726 F. App’x 841 (2d Cir. 2018). 

114 KPMG Peat Marwick, 2001 WL 47245, at *26; see also Steadman, 603 F.2d 

at 1140.
20

“whether the violation is recent, the degree of harm to investors or the 

marketplace resulting from the violation, and the remedial function to be 

served by the cease-and-desist order in the context of any other sanctions being 

sought in the same proceedings.”115 No single factor in this analysis is 

dispositive, and the entire record is considered when deciding whether to issue 

a cease-and-desist order.116

The fact CYIOS and Carnahan committed the charged violations shows

the likelihood of future violations. Their misconduct was egregious. CYIOS 

violated the antifraud provision of Securities Act Section 17(a)(3) by falsely 

representing in its periodic filings that its management followed an established 

framework when assessing its internal controls.117 The misstatements 

appeared in numerous periodic filings over a period of about three years, 

highlighting the misconduct’s recurrent nature. Carnahan was fully 

responsible for CYIOS’s filings and admitted that he was the company’s only 

internal control. He acted with scienter by knowingly making false statements 

in those filings, and his scienter is imputed to CYIOS.118 Carnahan also 

repeatedly included false certifications with those filings and failed to assess 

CYIOS’s internal controls using any suitable framework, in violation of 

Exchange Act Rules 13a-14 and 13a-15(c). This had the potential to cause 

“serious harm to investors and the marketplace.”119

Further, Carnahan decided to stop making CYIOS’s required periodic 

filings. He thus caused CYIOS’s violation of “a central provision of the 

Exchange Act, ... depriv[ing] both existing and prospective holders of its 

registered stock of the ability to make informed investment decisions based on 

 

115 KPMG Peat Marwick, 2001 WL 47245, at *26.

116 Id.

117 See Peter Siris, Exchange Act Release No. 71068, 2013 WL 6528874, at *6 

(Dec. 12, 2013) (“[The Commission has] repeatedly held that conduct that 

violates the antifraud provisions of the securities laws is especially serious and 

subject to the severest of sanctions under the securities laws.” (internal 

quotation marks omitted)), pet. denied, 773 F.3d 89 (D.C. Cir. 2014).

118 See Aaron, 446 U.S. at 686 n.5; Blizzard, 2004 WL 1416184, at *5.

119 Rockies Fund, Inc., Exchange Act Release No. 54892, 2006 WL 3542989, 

at *5 (Dec. 7, 2006) (“The dissemination of false and misleading financial 

information, such as in the periodic reports at issue, causes serious harm to 

investors and the marketplace.”), pet. denied, 298 F. App’x 4 (D.C. Cir. 2008).
21

current and reliable information.”120 CYIOS and Carnahan’s “long history of 

ignoring ... reporting obligations evidences a high degree of culpability.”

121

Moreover, Carnahan’s own decision shows that the “violations here were 

intentional.”

122 

Respondents have made no assurances against future violations. Further 

underscoring the significant risk of future violations, Carnahan has not 

recognized the wrongfulness of the misconduct and in his closing argument 

simply claimed the Division did not present evidence of wrongdoing.123 As the 

control person for CYIOS, Carnahan’s occupation presents the opportunity for 

CYIOS to again become public and resume its misconduct. The Steadman

factors thus weigh in favor of strong sanctions.

The factors specific to issuing a cease-and-desist order further show that 

such an order is appropriate. Although the violations are not recent, “this 

consideration is outweighed by the other factors previously discussed.”124

There is no evidence quantifying monetary losses to investors; however, 

investors were deprived of current information when CYIOS stopped filing its 

reports and were misled into believing that CYIOS’s management evaluated 

its internal controls using a recognized framework.125 Instructing Carnahan 

 

120 Accredited Bus. Consolidators Corp., Exchange Act Release No. 75840, 

2015 WL 5172970, at *2 (Sept. 4, 2015); see also Phlo Corp., 2007 WL 966943,

at *13 (describing a respondent’s repeated failure to timely file its periodic 

reports as “serious”).

121 Citizens Capital Corp., Exchange Act Release No. 67313, 2012 WL 

2499350, at *5 (June 29, 2012) (internal quotation marks omitted).

122 Id.

123 See Tr. 131; see also Geiger v. SEC, 363 F.3d 481, 489 (D.C. Cir. 2004) 

(“[The respondent] still thinks he did nothing wrong, which casts doubts on his 

promise that he will mend his ways.”); Jose P. Zollino, Exchange Act Release 

No. 55107, 2007 WL 98919, at *6 (Jan. 16, 2007) (“[F]ailure to acknowledge 

guilt or show remorse indicates that there is a significant risk that, given the 

opportunity, [the respondent] would commit further misconduct in the 

future.”).

124 Robert W. Armstrong, III, Exchange Act Release No. 51920, 2005 WL 

1498425, at *15 (June 24, 2005).

125 See McConville, 2005 WL 1560276, at *16 (“Fraudulent misstatements 

and omissions in financial statements and periodic reports mislead investors 

who buy or sell stock based on the information contained therein.”); see also 
22

and CYIOS to not violate the securities laws in the future does not prejudice 

them and, in conjunction with the sanctions discussed below, is an appropriate 

remedy. 

Based on the entire record, a cease-and-desist order is warranted against 

CYIOS and Carnahan. 

2. Civil Penalties

Securities Act Section 8A(g) and Exchange Act Section 21B(a)(2) authorize 

civil penalties in cease-and-desist proceedings against any person who has 

violated, or caused a violation of, a provision of those acts or a rule or regulation 

promulgated under either act.126 These provisions both outline a three-tiered 

system for determining the maximum civil penalty for each act or omission. 

First-tier penalties are available based on the fact of the violation alone.127

Second-tier penalties may be imposed if the misconduct involved fraud, deceit, 

manipulation, or deliberate or reckless disregard of a regulatory 

requirement.128 Third-tier penalties require the additional finding that the 

misconduct, directly or indirectly, “resulted in substantial losses or created a 

significant risk of substantial losses to other persons or resulted in substantial 

pecuniary gain” to the respondent who committed the violation.129

The Division requests that I impose seventeen third-tier penalties.130 The 

basis for the number is clear; it is derived from the number of periodic filings 

containing misstatements, plus the required filings that were not made.131 The 

basis for the tier is less clear, however. Although the Division asserts 

 

SEC v. Dresser Indus., Inc., 628 F.2d 1368, 1377 (D.C. Cir. 1980)

(“Dissemination of false or misleading information by companies to members 

of the investing public may distort the efficient workings of the securities 

markets and injure investors who rely on the accuracy and completeness of the 

company’s public disclosures.”).

126 15 U.S.C. §§ 77h-1(g)(1), 78u-2(a)(2). 

127 15 U.S.C. §§ 77h-1(g)(2)(A), 78u-2(b)(1).

128 15 U.S.C. §§ 77h-1(g)(2)(B), 78u-2(b)(2).

129 15 U.S.C. §§ 77h-1(g)(2)(C), 78u-2(b)(3).

130 Div. Br. 19–20.

131 Div. Br. 20. 
23

Respondents “created a ‘significant risk of substantial losses,’” it does not 

explain why this is the case.132

The record nonetheless supports second-tier penalties for Respondents’

misconduct. Respondents’ misconduct relating to the false statements in 

CYIOS’s periodic filings was committed with scienter and was deceitful.133

Respondents also deliberately disregarded regulatory requirements when they

failed to file periodic reports. Indeed, Carnahan was aware of those 

requirements yet decided to stop making the filings. 

When determining whether civil penalties are in the public interest, the 

Commission considers six factors listed in the securities statutes: (1) whether 

the violation involved fraud, deceit, manipulation, or deliberate or reckless 

disregard of a regulatory requirement; (2) the resulting harm, directly or 

indirectly, to other persons; (3) any unjust enrichment and prior restitution; 

(4) the respondent’s prior regulatory record; (5) the need for deterrence; and 

(6) such other matters as justice may require.134 As I have already found, the 

first factor is satisfied. As discussed in determining that a cease-and-desist 

order is appropriate, while investor harm cannot be quantified, Respondents’

misconduct harmed investors in that it deprived investors of current 

information about CYIOS and misled them due to repetitive misstatements 

about the company’s internal controls. CYIOS was unjustly enriched by 

obtaining consulting services in exchange for its stock. There is no evidence 

that either Carnahan or CYIOS have a disciplinary history. There is, however,

a need to deter them and others from future misconduct. There are no 

 

132 Div. Br. 20. The only record evidence of the trading volume and price of 

CYIOS’s stock suggests that on all but a few days total trading volume was 

well under $5,000, see generally Div. Ex. 26, which makes the potential losses 

to investors less likely to be characterized as substantial. Moreover, although 

the Division points to Carnahan’s income as substantial, Div. Br. 19; Div. Ex. 

3 at 119, it has made no showing that his income resulted from his misconduct.

133 See SEC v. M&A W., Inc., 538 F.3d 1043, 1054 (9th Cir. 2008) (“[T]he 

imposition of second-tier penalties requires an assessment of scienter.”).

134 See, e.g., 15 U.S.C. § 78u-2(c). When assessing the public interest under 

the Securities Act, the Commission considers the factors listed under the other 

securities statutes as the Securities Act does not contain a statutory list of 

public-interest factors. See Dembski, 2017 WL 1103685, at *15 & n.70; Thomas 

C. Gonnella, Securities Act Release No. 10119, 2016 WL 4233837, at *14 & 

n.70 (Aug. 10, 2016), pet. argued, No. 16-3433 (2d Cir. Sept. 9, 2019); see 

generally 15 U.S.C. § 77h-1.
24

indications that Respondents understand the gravity of their misconduct. 

Carnahan ran a public company without proper internal controls and 

knowingly caused that company to make false statements to the investing 

public indicating otherwise. On balance, significant penalties are warranted.

Although the securities statutes provide that a penalty may be imposed 

for each act or omission, they leave the precise unit of violation undefined.

135

Based on the record, two second-tier penalties are appropriate against each 

Respondent. The first is imposed for the misconduct relating to the 

misstatements about CYIOS’s internal controls, and the second is imposed for 

the failure to make required periodic filings. These violations are aptly 

considered as two courses of misconduct. Imposing a penalty for each filing 

that contained a misstatement and each missed filing, as the Division 

proposes, would be unduly punitive in the circumstances of this case. Although 

I could also impose penalties for each of Carnahan’s false certifications, I 

decline to do so, as I consider those certifications part of the same course of 

misconduct as the misstatements.

Maximum second-tier penalties of $75,000 for each violation by an 

individual and $375,000 for each violation by an entity may be imposed for 

violations occurring during the misconduct’s timeframe.136 Particularly in view 

of the deceitful nature of the misstatement-related misconduct, the maximum 

amount against each Respondent is appropriate for that misconduct. But as to 

the missed periodic filings, it is appropriate to impose lesser penalties of

$125,000 against CYIOS and $25,000 against Carnahan. Accordingly, I will 

order that Carnahan pay a total civil monetary penalty of $100,000 and that 

CYIOS pay a total civil monetary penalty of $500,000.

3. Disgorgement and Prejudgment Interest

Securities Act Section 8A(e) and Exchange Act Section 21C(e) authorize 

disgorgement in cease-and-desist proceedings, and Exchange Act Section 

21B(e) authorizes disgorgement in proceedings where civil monetary penalties 

may be imposed.137 “Disgorgement is an equitable remedy designed to deprive 

a wrongdoer of [its] unjust enrichment and to deter others from violating the 

 

135 Fields, 2015 WL 728005, at *24 n.162.

136 See 17 C.F.R. § 201.1001, tbl. I.

137 See 15 U.S.C. §§ 77h-1(e), 78u-2(e), 78u-3(e). 
25

securities laws.”138 To establish the appropriate amount of disgorgement, the 

Division need only show “a reasonable approximation of profits causally 

connected to the violation” in question.139 Ordinarily, once the Division makes 

the required showing, the burden shifts to the respondent to show that the 

disgorgement figure was not a reasonable approximation.140

The Division has shown, and CYIOS has not disputed, that CYIOS 

received $37,500 worth of consulting services by exchanging its publicly traded 

stock for such services while the company’s periodic filings contained material 

misstatements in violation of Section 17(a)(3).141 Because CYIOS’s 

misstatements about its internal controls were material—for the reasons 

discussed earlier in this decision—a provider of consulting services would 

consider those false disclosures important in deciding whether to accept stock 

compensation. The receipt of these services in exchange for the company’s stock 

was thus causally connected to the violation.142 The value of these consulting 

services is an unjust enrichment subject to disgorgement, as otherwise CYIOS 

would retain a free benefit it gained while violating the law.

143 The Division 

reasonably approximated the value of these services based on CYIOS’s stated 

 

138 Montford, 2014 WL 1744130, at *22 (quoting SEC v. First City Fin. Corp., 

890 F.2d 1215, 1230 (D.C. Cir. 1989)). 

139 First City Fin., 890 F.2d at 1231; see also Montford & Co. v. SEC, 793 F.3d 

76, 83–84 (D.C. Cir. 2015).

140 SEC v. Calvo, 378 F.3d 1211, 1217 (11th Cir. 2004).

141 Div. Ex. 12 at 274, 277. 

142 See Jay T. Comeaux, Securities Act Release No. 9633, 2014 WL 4160054, 

at *3 (Aug. 21, 2014) (“The Division need only show but-for causation between 

a defendant’s violations and profits.”). 

143 Cf. SEC v. Contorinis, 743 F.3d 296, 306 (2d Cir. 2014) (rejecting the 

principle that disgorgement is limited to the amount of direct pecuniary benefit 

to the wrongdoer, and recognizing that a “wrongdoer’s unlawful action may 

create illicit benefits for the wrongdoer that are indirect or intangible”); SEC 

v. Great Lakes Equities Co., 775 F. Supp. 211, 214 (E.D. Mich. 1991) (“The 

benefit or unjust enrichment of a defendant includes not only what it gets to 

keep in its pocket after the fraud, but also the value of the other benefits the 

wrongdoer receives through the scheme.”), aff’d, 12 F.3d 214 (6th Cir. 1993) 

(unpublished).
26

value of its stock issued in exchange for the services.144 CYIOS has made no 

contrary showing.145

Accordingly, CYIOS will be ordered to disgorge $37,500 in ill-gotten gains, 

with interest due from December 1, 2012, which is the first day of the month 

after CYIOS’s last periodic filing—an amended Form 10-Q—that contained a 

material misstatement.146

Record Certification

I certify that the record includes the items set forth in the record index 

issued by the Secretary of the Commission on September 9, 2019.147

Order

Under Section 8A of the Securities Act of 1933 and Section 21C of the 

Securities Exchange Act of 1934:

CYIOS Corporation must CEASE AND DESIST from committing any 

violations or future violations of Section 17(a)(3) of the Securities Act of 

1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange 

Act Rules 13a-1 and 13a-13; and 

Timothy W. Carnahan must CEASE AND DESIST from causing any 

violations or future violations of Section 17(a)(3) of the Securities Act of 

1933, Section 13(a) of the Securities Exchange Act of 1934, and Exchange 

Act Rules 13a-1 and 13a-13; and from committing any violations or future 

violations of Exchange Act Rules 13a-14 and 13a-15. 

 

144 See SEC v. Bilzerian, 814 F. Supp. 116, 123 (D.D.C. 1993) (“A reasonable 

approximation of defendant’s illicit profit is the amount he gained while in 

violation of the law.”), aff’d, 29 F.3d 689 (D.C. Cir. 1994); see also id. at 121 

(“As it is nearly impossible and speculative to determine the market price but 

for the illicit conduct, a reasonable approximation of this amount must suffice.” 

(internal citation omitted)).

145 See Zacharias v. SEC, 569 F.3d 458, 473 (D.C. Cir. 2009) (“[T]he burden 

of uncertainty in calculating ill-gotten gains falls on the wrongdoers who create 

that uncertainty.”).

146 See 17 C.F.R. § 201.600(a). 

147 See 17 C.F.R. § 201.351(b). 
27

Under Section 8A(g) of the Securities Act of 1933 and Section 21B(a) of the 

Securities Exchange Act of 1934:

CYIOS Corporation must PAY A CIVIL MONEY PENALTY in the amount 

of $500,000; and

Timothy W. Carnahan must PAY A CIVIL MONEY PENALTY in the 

amount of $100,000.

Under Section 8A(e) of the Securities Act of 1933 and Sections 21B(e) and 

21C(e) of the Securities Exchange Act of 1934: 

CYIOS Corporation must DISGORGE $37,500.00, plus prejudgment 

interest. The prejudgment interest owed will be calculated from December 

1, 2012, to the last day of the month preceding the month in which 

payment of disgorgement is made. Prejudgment interest will be computed 

at the underpayment rate of interest established under Section 6621(a)(2) 

of the Internal Revenue Code, 26 U.S.C. § 6621(a)(2), and compounded 

quarterly.148

Payment of civil penalties, disgorgement, and interest must be made no 

later than 21 days following the day this initial decision becomes final, unless 

the Commission directs otherwise. Payment must be made in one of the 

following ways: (1) transmitted electronically to the Commission, which will 

provide detailed ACH transfer/Fedwire instructions upon request; (2) direct 

payments from a bank account via Pay.gov through the SEC website at 

http://www.sec.gov/ofm; or (3) by certified check, bank cashier’s check, bank 

money order, or United States postal money order made payable to the 

Securities and Exchange Commission and hand-delivered or mailed to the 

following address alongside a cover letter identifying Respondent(s) and 

Administrative Proceeding No. 3-16386: Enterprise Services Center, Accounts 

Receivable Branch, HQ Bldg., Room 181, AMZ-341, 6500 South MacArthur 

Blvd., Oklahoma City, Oklahoma 73169. A copy of the cover letter and 

instrument of payment must be sent to the Commission’s Division of 

Enforcement, directed to the attention of counsel of record.

This initial decision will become effective in accordance with and subject 

to the provisions of Rule 360.149 Under that rule, a party may file a petition for 

review of this initial decision within 21 days after service of the initial decision. 

Under Rule of Practice 111, a party may also file a motion to correct a manifest 

 

148 See 17 C.F.R. § 201.600(b).

149 See 17 C.F.R. § 201.360. 
28

error of fact within ten days of the initial decision.150 If a motion to correct a 

manifest error of fact is filed by a party, then a party has 21 days to file a 

petition for review from the date of the order resolving such motion to correct 

a manifest error of fact. 

The initial decision will not become final until the Commission enters an 

order of finality. The Commission will enter an order of finality unless a party 

files a petition for review or motion to correct a manifest error of fact or the 

Commission determines on its own initiative to review the initial decision as 

to a party. If any of these events occur, the initial decision will not become final 

as to that party.

_______________________________

James E. Grimes

Administrative Law Judge

 

150 See 17 C.F.R. § 201.111.