The NASPP Blog

I recently had to update my EDGAR passphrase.  I thought this would be a relatively simple process. I’m a smart person and I have a proven success rate in navigating government websites—I know how to use the DMV website to make an appointment, I’ve requested a certified copy of my birth certificate online, I can find a public company’s stock plan on EDGAR—how hard could it be to update my EDGAR password?  Turns out, way harder than I expected.

This is a long blog entry, but it’s not my fault. I blame the SEC (and maybe Microsoft).

How I Got Into this Mess

I got my EDGAR access codes over a decade ago, back when the SEC first rolled out the system for filing Section 16 forms online. It was so long ago, it was before the SEC required a notarized Form ID or a passphrase. I did not want to go through the hassle of submitting a notarized form to the SEC, so I had a system in place to make sure I didn’t forget to update my EDGAR password, which consisted of a reminder in my Outlook calendar set for about a month before my EDGAR password expired.  Once a year, the reminder would pop up and—unlike how I respond to my alarm clock—I would not ignore it or hit snooze. I would immediately update my EDGAR password and set the reminder for the next year.

This system worked fantastically for over a decade, including through a change in employers. And then I got a new laptop with Outlook 13 on it. Outlook 13 had some sort of “known issue” that caused emails to disappear from my inbox. The only way to fix it was to remove Outlook 13 and go back to Outlook 10. In the process, my entire calendar was lost. Completely gone.

After massive hyperventilating and gnashing of the teeth, I was able to recreate most of it, but there were some appointments I forgot—including the reminder about my EDGAR password.

Fixing an Expired EDGAR Password

To update an expired EDGAR password, you have to generate a new set of EDGAR codes. This requires a passphrase.  I had no idea what my passphrase was because the passphrase system wasn’t in place when I originally got my EDGAR codes, hence I didn’t have it noted in any of the various places where I have made note of my EDGAR codes (this was regrettable on my part).  Here’s what I needed to do:

1. Generate a new passphrase. This required me to submit an Update Passphrase Confirmation form, which has to be notarized. I thought getting the notarization would be hard, and it was, mainly because I kept forgetting to bring the form with me when I met with my notary friend who would notarize the form for free.

This part was also very confusing because the only way to get the Update Passphrase Confirmation form is to fill out an online request for a new passphrase.  But the SEC won’t issue a new passphrase until the notarized form is submitted, so I would have to come back and complete this very same online form again once I had my notarization. Essentially, you complete one new passphrase request that the SEC completely ignores. Then, once you have your notarized form, you complete a second request that the SEC will act on if you can manage to submit your notarized form properly (see steps 2 to 5).

Finally, to add to my frustration, it took several tries to come up with a passphrase that would meet the SEC’s crazy specifications so that I could print the form that I had to have notarized.  (Note to the SEC: a password that is so complicated to remember and so hard to update that you write it down in multiple places it is a total security fail.)

2. Months later, after I finally got the form notarized (access to EDGAR isn’t really a pressing concern for me on a day-to-day basis), I had to go back to EDGAR to submit the form.

3. Of course I first tried this after 7:00 PM Pacific (I am in California) and EDGAR is shut down for the night at that time. Despite how ridiculous this is for an online system, it shouldn’t have been a surprise; as soon as I got the error message, I remembered that EDGAR shuts down for the night.

4. The next day I thought I was all set.  I had my form and it was between 3:00 AM and 7:00 PM Pacific.  Thankfully, the EDGAR system let me use the same passphrase I had come up with after several tries in step 1, so I didn’t have think of another one.  But I still made every error in the book before I could submit the form—my file name was too long, then it had spaces, then it had capital letters, then my reason for needing to update my passphrase was too long, then it included profanity (just kidding, I did not swear at the SEC, at least not in writing).

5. After several tries, I finally managed to submit my update passphrase request form without getting an immediate error. I took this to be a good sign, even though there was no way I could tell that the submission had succeeded, since I got the same “submission completed” screen that I got when the submission failed.

6. Then I waited.  After two business days, I received an email that my request to change my passphrase had been accepted. This was a major hurdle overcome, but I still had to go in and generate my new EDGAR codes.

7. Guess what time it was when I tried generate my new EDGAR codes:  yep, after 7:00 PM Pacific (this is one of my most productive time periods).  So I set an appointment in my calendar to remind me to generate my codes before 7:00 PM the next day (no worries about me trying to generate them before 3:00 AM).

8. The next day, my reminder pops up and I go to generate my new EDGAR codes. After all this, I am positively holding my breath that I wrote down my passphrase correctly because I sure as heck didn’t want to have to start this whole process again. Luckily, I am at least competent in this one thing, because the passphrase worked and I finally have my new EDGAR codes.  Phew!

Lesson Learned

You might think the lesson I learned is to not let my EDGAR password expire, but that isn’t it all. The lesson I learned is …

Don’t forget your EDGAR passphrase!

If I had just remembered my passphrase, this whole blog entry could have been avoided. Maybe I should rent a safe deposit box or get one of those fireproof safes just to store my EDGAR passphrase.

Wondering why EDGAR is such a hot mess? Check out this nifty podcast that explains the problem with government websites: “DMV Nation.”

– Barbara