With the increased use of technologies such as the Internet and the dependence on computer systems to perform necessary business functions, the Trust is susceptible to operational and information security risks. In general, cyber incidents can result from deliberate attacks or unintentional events. Cyber attacks include, but are not limited to gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption.
Cyber attacks may also be carried out in a manner that does not require gaining unauthorized access, such as causing denial-of-service attacks on websites. Cyber security failures or breaches of the Trust's third party service providers (including, but not limited to, the Trustee and the Sponsor) have the ability to cause disruptions and impact business operations, potentially resulting in financial losses, the inability of Shareholders or Authorized Participants to transact business in Shares and Baskets respectively, violations of applicable privacy and other laws, regulatory fines, penalties, reputational damage, reimbursement or other compensation costs, and/or additional compliance costs. In addition, substantial costs may be incurred in order to prevent any cyber incidents in the future. The Trust and its Shareholders could be negatively impacted as a result.
While the Sponsor has established business continuity plans and systems reasonably designed to detect and prevent such cyber attacks from being effective, there are inherent limitations in such plans and systems. For instance, it is possible that certain existing risks have not been identified or that new risks will emerge before countervailing measures can be implemented. Furthermore, the Trust cannot control, or even necessarily influence, the cyber security plans and systems put in place by the Trust's third party service providers. Since the Trust is dependent upon third party service providers (including the Sponsor and Trustee) for substantially all of its operational needs, the Trust is subject to the risk that a cyber attack on a service provider will materially impair its normal operations even if the Trust itself is not subject to such an attack. In addition, a service provider that has experienced a cyber security incident may divert resources normally devoted to servicing the Trust to addressing the incident, which would be likely to have an adverse effect on the Trust's operations.