Over many years, both in private practice and in-house as a lawyer and in my work in financial crime risk and compliance, the question of the criminal liability for customers has often arisen. It's in my books, training courses and seminars and there are many other books on the subject, many quite recent.

The liability of companies is complex but boils down to this: a company is legally a person but it has no capability to form intent. That happens as a result of the actions, or inactions, of its directors who are described as "the directing mind".

But it is rare for directors to be prosecuted for the actions, or inactions, by companies unless there is unequivocal evidence that the director was acting in his own interest and using the company as an agent. Often people seem to confuse the concept of limited liability for shareholders and assume that a) it covers non-financial conduct and b) it extends to directors. Some directors, knowing that not to be so, purport to enter into an agreement with the company for indemnity if consequences flow from the holding of the office of director.

This, globally, has led to a widespread feeling that it's just too hard to prosecute corporate crime in the absence of strict liability. Vicarious liability is, in most jursdictions, an unwelcome charge.

For example, yesterday the USA's Securities and Exchange Commission entered into a settlement agreement (I think they are a combination of extortion and bribery) with a company called Becton, Dickinson and Company, a New Jersey-based medical device manufacturer known as BD, for repeatedly misleading investors about risks associated with its continued sales of its Alaris infusion pump and for overstating its income by failing to record the costs of fixing multiple software flaws with the pump. BD agreed to pay a USD175 million civil penalty.

So, here we have, on the face of it, accounting irregularities (if you or I did this when preparing our tax returns, it would be a criminal fraud) which led to the over-valuation of the company's shares (market manipulation, anyone? )

The company's culpability is serious (see the extract from the SEC's press release below) but it's dealt with by a civil complaint, not criminal charges (despite the SEC's use of the word "charge").

The SEC almost never pursues the directors who directed the company resulting in malfeasance. In fact, around the world, that is almost always reserved for cases resulting in insolvency.

Criminal cases usually depend on two things: proof that a person performed an act in breach of the criminal law and that that person intended to perform that act. A company is a person in law (a partnership is not) but it is not capable of forming intent.

This question has far wider implications than we might first thing: it is not in a silo. For example, it is long established that a vending machine that accepts your money but does not deliver the product does not commit a crime because it cannot form the intent to take your money and fail to deliver. But today there are people trying to undermine that simple principle by saying that machines have intelligence and make decisions. So, if a company can be held liable, does that mark a direction of travel for the criminal liability of machines?

Intent v Motive

There is a widespread confusion where many think intent and motive are the same but they are not. Intent is "did x intend to do it?" whereas motive is "why did x do it?" Intent goes to guilt, motive goes to sentencing / penalty.

So far as companies, and by association machines, are concerned they are not capable of forming intent nor of having a reaon for their conduct.

In relation to motive, the only answer is "because someone instructed it to do that."

But in civil penalty systems, such as the SEC and many others, motive is irrelevant. The criminal law can learn from this and it has, in many jurisdictions already moved in this direction. Criminal conduct is traditionally punished with reference to consequences only where they have a financial value that can be calculated. However, the growth of witness impact statements has expanded this to where judges are influenced by wider consequences. Can this indicate a way in which criminal liability may be going, with a blurring of lines so that liability is not quite so black and white?

We'll see. There is no doubt that the area is in grave need of review and that to make that move will influence the future of laws relating not only to bodies corporate but to devices that do not exercise thought, too.

Did it happen or did it not?

When the SEC settles cases including the terms "without admitting or denying" there's a reason for defendants to insist on this: it means that the decision cannot be relied upon by shareholders who might try to claim that the value of their shares has deminished because of the action that the SEC has complained about. The big question is whether the SEC should make such a concession. I argue not: from the shareholders' perspective, why is the company paying the SEC to go away if it doesn't accept there was a fault? The same argument arises in sanctions cases where a penalty is paid because of an "alleged" breach. Shareholders should not be put off, courts should see those words as having no value and regulators should stop entering such terms.

If we are to make strides in relation to corporate liability, there should be no no-go areas and consequences should flow, not to be hedged.

Unedited extract from the SEC's press release. All errors are theirs.

According to the SEC’s order, BD determined in 2016 that software changes made to the Alaris pump required regulatory clearance from the Food and Drug Administration (FDA). However, BD did not have the data required for clearance, and generating the data would delay the release of new features, so BD continued selling the pump without clearance. By January 2019, BD identified more than 25 flaws in the pump’s software that its experts categorized as presenting risks of the greatest potential harm to patients. Rather than inform investors that these issues heightened the risk that the FDA would limit BD’s ability to continue selling Alaris—a product whose sales contributed about 10 percent of BD’s profits—BD made misleading statements in its periodic reports about its regulatory risks.

The order finds that BD revealed Alaris’s software flaws to the FDA in October 2019 and proposed that the agency allow it to continue selling the pump while it worked to fix the flaws and complete the lengthy FDA clearance process. The FDA firmly rejected this proposal so BD immediately stopped shipping Alaris. But several days later, BD decided it would resume shipping the pump after fixing its software flaws – without FDA clearance. During an earnings call in early November 2019, BD misleadingly told investors that it was pausing Alaris sales to make “some improvements” to the pump as part of its strategy to “continually iterate and make enhancements to the platform.” BD also made financial forecasts for fiscal year 2020 without warning investors that those forecasts were based on conjecture that the FDA would allow BD to resume sales of Alaris without clearance.

The order finds that, in mid-November, BD changed its plan; it would resume shipping Alaris with a new version of the software that would exclude fixes that required FDA clearance. This meant BD would not fix several flaws the FDA had expressed significant concerns about, making it even less likely that the agency would allow BD to fully resume Alaris sales. Nevertheless, during subsequent investor conferences in November and December 2019, BD echoed its prior misleading statements.

The order finds that BD resumed shipping Alaris with the new software in December 2019 without any indication from the FDA that it concurred with this approach. After the FDA learned in January 2020 what BD had done, the agency warned that BD’s decision to resume selling Alaris was “misaligned with our previous conversations regarding your software issues and our mutual agreement that your firm should not be distributing devices to new customers.” BD reinstated the ship hold and understood there would likely be a materially negative impact on the company’s revenue in fiscal year 2020. Nevertheless, during its subsequent annual shareholders meeting in late January 2020, BD again reaffirmed its prior fiscal year 2020 revenue guidance. BD finally told investors in February 2020 that it had ceased shipping Alaris and would not resume normal sales until it had completed the lengthy FDA clearance process. Its share price subsequently declined 12 percent. Following the announcement, one analyst texted a senior member of BD’s investor relations group, “I do not understand what happened here. 10 days ago we heard everything in pumps was ok and back on market and better than expected . . . I’m stunned and have a lot of angry people with pitchforks.”

“BD repeatedly painted a misleading picture of its Alaris infusion pump for investors and then doubled down by keeping them in the dark when the device’s issues came to a head with the FDA in late 2019,” said Sanjay Wadhwa, Acting Director of the SEC’s Division of Enforcement. “Public companies have a fundamental duty to accurately disclose material business risks and should expect to be held accountable when they fall short in that regard.”

The SEC’s order finds that BD materially overstated its operating income in FY2019 by failing to properly account for the costs of remediating Alaris to fix the software flaws, resulting in the company overstating its operating income in the fourth quarter of fiscal year 2019 by 82 percent.

The SEC’s order finds that BD violated antifraud, reporting, internal accounting controls, books and records, and disclosure controls provisions of the federal securities laws. Without admitting or denying the SEC’s findings, BD agreed to cease and desist from further violations of these provisions, to retain an independent compliance consultant to review and make recommendations concerning its disclosure controls and procedures, and to the civil penalty referenced above.