How confidential are closed-door meetings at the Securities and Exchange Commission? If an executive session involving representatives of JPMorgan last year is at all typical, not very.

A new report by the Commission’s Office of Inspector General (website The Hill obtained and published a copy) found a variety of ways that nonpublic information from SEC executive sessions may not be well-protected, including media leaks, failing to clear the meeting room of unrelated observers, that the room isn’t soundproof, and the practice of sending confidential attachments to personal e-mail accounts.

The OIG report reacts to concerns expressed by Commissioner Michael Piwowar after members of the media, in particular Reuters reporters, were aware of comments he made, as well as other details that emerged during an executive session held on Sept. 12, 2013. Five days later, many of these details emerged in an article entitled “JPM’s Whale Troubles May not End with Civil Settlement.” Information about the vote was not made public until Sept. 19.

As part of OIG’s investigation, it reviewed e-mails, outgoing telephone logs, and BlackBerry records for more than 50 SEC employees, from commissioners to staffers. The report says the investigation was “unable to conclude which specific individual or individuals had improperly disclosed information” from the meeting, but nevertheless uncovered concerning practices.

As for a direct leak to the media, whoever did so was in conflict with SEC rules for press relations. “It is a violation of the SEC’s conduct regulation, and may be a violation of other SEC rules and of provisions of the securities laws, for any employee to reveal nonpublic information unless specifically authorized to do so by formal SEC action, either directly r through delegated authority,” those rules say.

Another issue raised in the OIG report is that the meeting room may not have been properly cleared. As a practice, prior to executive session meetings, the presiding chairman reads the following disclaimer: “Only staff authorized by the Commission’s executive session attendance policy should be in the room or on video.” Although staffare supposed to clear the room after each executive session and ensure attendance is limited to those on an approved roster, at times it began announcing or deliberating the next matter before the room has been cleared from the previous matter, staffers told investigators.

Part of the confusion regarding the particular session under scrutiny, is that Chairman Mary Joe White and Commissioner Daniel Gallagher both recused themselves, leaving Commissioner Luis Aguilar holding the gavel. “In their interviews with the OIG, members of Chair White’s Staff indicated that they approached Aguilar about clearing the room before the Commissioners voted on the JPMorgan matter, but [he] allowed everyone in the Executie Session to stay for the vote,” the report says. “Commissioner Aguilar told the OIG that he was uncertain who was supposed to leave for the vote and sought guidance.” Although counsel from White’s office advised him that certain people should leave the room, other staffers indicated that it was okay for everyone to stay and he relied on that advice.

The report adds that staffers familiar with the meeting room say “it is possible for people standing outside the closed commission meeting room to hear the discussions and votes through closed doors.”

Aguilar is also mentioned in the report because his telephone records showed four calls placed to one of the Reuters reporters between Sept. 12-19, including one call made approximately 35 minutes after the conclusion of the executive session on the JPMorgan matter. The duration of those calls, however, indicate that there was no substantial conversation. Two SEC employees were also in contact with the reporters in question, although neither was singled out for leaking information.

Aguilar was also chided for sending “nonpublic information related to enforcement matters to his personal email account.” He said those 11 emails and 13 attachments were sent to a personal account because, at home, he could not print from the secure gateway intended for off-site e-mail access. He told investigators that he did not view sending nonpublic SEC information to his personal email as a problem that “violated the SECs rules of the road,” the report says, adding that he had nevertheless completed annual security and awareness training that addressed the prohibition of sending non-public information to personal email accounts.

The report was delivered to SEC  Commissioners for their review and further action.