Rogue Code Page 8

  Within minutes of offering its stock, BATS announced it was having “system issues” with its own IPO. Ironically BATS stands for “better alternative trading system.” To everyone’s surprise, the company’s software was unable to accurately display ticker symbols for a wide range of stocks. Then a single trade for just 100 Apple shares executed by BATS drove the stock down more than 9 percent. The Apple stock quickly recovered, but confidence in the ability of BATS to handle trades did not.

  A high-profile public offering by such a well-known company draws keen media and public interest. Yet too often in recent years there have been significant problems with them. These problems have often been complex and buried within the vast software used to control the offering. As a consequence, what went wrong is often never adequately identified or fully grasped.

  These new trading problems are the product of computers, and while computing power has increased efficiency and profits, it has also brought with it new issues that are still not entirely comprehended. The reality is that no one really understands the complex software. All major companies now have board-level risk committees charged with assessing what is taking place and alerting the company to what it needs to do. Yet time and again, the measures taken to prevent the problem BATS experienced have, upon examination, been found to have caused them, or at the least have proved inadequate in stopping them. The consequence has been the notorious Flash Crash and serious glitches in the Facebook IPO.

  BATS had been an expert at IPOs, and yet it fell victim to its own bad software and predatory HFTs that sold the stock short once their algos sniffed blood. Its stock fell to pennies by the time the company abandoned the IPO, which was immediately deemed the worst of all time. BATS has announced no date for its next attempt.

  HFTs tend to lurk offshore. No one knows how many there are or how vast their holdings. Their ability to manipulate the market is coming under increased scrutiny. In some instances, their motives have even been questioned, as it is not clear who controls them.

  But for now, BATS remains the first IPO killed by HFTs.

  FOR MORE INFORMATION, VISIT LESLIEWASHINGTON-TONE.COM

  International PC Review

  13

  EDIFÍCIO REPÚBLICA

  RUA SÃO BENTO

  SÃO PAULO, BRAZIL

  9:23 A.M.

  Victor Bandeira climbed into his taxi helicopter, gave Sergio, the pilot, a nod, and then sat back in his comfortable seat. Almost at once, the blades whirred and the agile craft lifted from the helipad atop the towering building. Sergio was one of the old guard, a foot soldier and bodyguard he’d relied on for years. He’d had him trained to serve as his pilot, not wanting to rely on outsiders.

  Bandeira adjusted his charcoal gray Armani suit and checked his watch. Though he adhered to the Latin custom of tardiness, especially when it was he who had called the meeting, he did not take it to extremes.

  The city skyline was spiked with gleaming glass towers, symbols of the new Brazil and its regional economic dominance. After five centuries, the nation was at last assuming a significant place in the world. Brazil had always been the land of destiny, filled with promise and expectation but falling short time and again, sinking into a morass of corruption and failure.

  There’d been frenzied eras of economic boom before, first made possible by sugar, later by coca, then by rubber. Each had brought enormous wealth into the country and made a handful of families very rich. But this boom-and-bust cycle, always dictated by circumstances outside the country, had never solidified into sustained growth or elevated Brazil to world power status.

  Now all that was changing. Over recent decades, the government had instituted initiatives to give the economy greater balance, and with the development of a vast oil reserve just off the coast, a measure of sustained prosperity at last seemed possible. Bandeira was not a patriot, but all these changes meant opportunity, and if nothing else, he considered himself a man who knew opportunity when he saw it.

  He took in the smog-shrouded skyline as the helicopter weaved its way among the towers. He counted a dozen other air taxis exactly like his own. At any time, there were as many as five hundred of them plying the busy skies over this city of twenty million. He looked through the brown blanket of smog beneath to the traffic-clogged streets even farther below. More than six million cars were crammed into those congested streets. He’d be two hours getting to his meeting down there. In the air, the trip took less than ten minutes. So it was that the rich and influential moved about São Paulo, flying above the masses like demigods.

  But convenience and efficiency weren’t the only reasons for the sky taxis. The sky was safer than taking the streets. Kidnapping was a cottage industry in the largest and richest South American city. More than one acquaintance and countless others Bandeira knew by reputation, men who had taken great measures to ensure their safety, had been seized off the street and held for ransom. If the kidnappers misjudged and asked for too much, if the family or business moved too slowly, or sometimes just to make an early point, an ear of the victim was hacked off and mailed.

  So common was the loss of an ear among the rich that more than one local surgeon specialized in its reconstruction, extracting naturally formed cartilage from within the victim’s body and from it creating a replacement. True, the new one was hard and unyielding but it looked like the real thing even on close examination. The daughter of one of his colleagues wore such an ear while two young men of his employ took another approach, proudly displaying the space where the ear had been shorn, testament that they’d been taken and survived the ordeal.

  One of Bandeira’s rare failures had been in his effort to control the local kidnapping trade. In his view, it was out of hand, targeting those it should not, giving the city a reputation for violence and danger that was not good for business. Bandeira had long planned to bring kidnappings under the control of his gang, Nosso Lugar, “Our Place,” or NL as it was known. But the other gangs, quadrilhas, engaged in kidnapping were too disorganized, too impulsive to be brought in hand. They viewed Bandeira with the same distrust with which they saw the official authorities.

  After several futile efforts, Bandeira had called a halt to his attempt—for now. He’d concluded that consolidating the gangs and bringing them under his control was possible only through a sustained violent effort. These thugs understood death. The consequence was that a significant number of them would have to be killed. The other approach was to kidnap members of their families, cut off a few ears, make demands. Only then would they begin to see the light.

  Bandeira had discussed this approach over lunch with the regional police and military commanders, two men with whom he’d worked for decades. The three of them had talked it through at length, and they’d agreed it could be done. And they were prepared to let Bandeira do it, providing cover as needed. If one gang was preying on another, it was possible that the media would accept it as a positive outcome and for once divert attention from law enforcement’s own failure. But both men had cautioned that only a sustained campaign of terror and violence could succeed. In the end, the gangs would have to be brought to heel. These were vicious men who lived violent lives, so nothing less than absolute dominance would work. A half effort would only bring on a war of greater ferocity, which they did not want.

  “What we need,” the city chief of police had said through his cigar smoke, “is a period of civil unrest. A time of street demonstrations, assassinations, vendettas, and murders to serve as cover for your operation. Who would know? And when all was over, you’d be in control.”

  The general smiled. “This is Brazil. We all know such a time is inevitable. If I were you, I’d plan accordingly. You can count on us,” he’d said reassuringly.

  So the plan was in place. The police and army fed information to NL every week, and one of Bandeira’s trusted captains kept the plan updated with names and addresses. When the time came, Bandeira’s organization would act. The consequence would be an end to random k
idnappings and the return of greater safety to the streets. Targeted kidnappings would become the norm, quiet ones that would still be lucrative. The wealthy of the city could breathe a little easier, and foreign investment would not be so timid.

  Bandeira contemplated the numerous ways he’d profit with a sense of satisfaction. The helicopter banked, righted, then began a gentle approach toward the round landing pad atop the gleaming Banco do Novo Brasil building. Bankers, Bandeira thought as he mentally reviewed that morning’s agenda, they should all be shot.

  14

  MULBERRY STREET

  NEW YORK CITY

  11:33 A.M.

  Now that Jeff and Frank had penetrated the NYSE engines and had free access to the core of the trading processes, they were in the final phase of their engagement. They continued employing the specialized tools that Jeff had devised over the years and which he guarded closely. They were the key to what he did and made his work not only less tedious but also more effective. The hardest part of the decision in hiring an outsider, even a friend like Frank, was granting access to these jewels.

  He had other tools, which he made commonly available at his presentations in order to spread his brand and facilitate better computer security. They were accordingly closely identified with his name and that of his company.

  At this point, the pair was mapping the extent of their success while also searching for other ways and paths to more deeply penetrate the system’s cyberdefenses. Having succeeded at their primary task, they took a more leisurely pace now, less intense. The pentest was essentially complete; what they did now was icing on the cake.

  Jeff could simply have informed Stenton of their success, but he had a reputation for going a step further and typically did something harmless to the system that persuaded even the most dubious company executive that he’d accomplished what he said he had. He reviewed things he’d done in the past, wanting to pull something clever and distinctive from his bag of tricks. He decided to ask Frank for ideas.

  Taking an early lunch, they’d stretched their legs and walked up to Chinatown. After selecting a restaurant at random, they sat in as quiet a corner as was possible in Manhattan at midmorning.

  “You know,” Frank said, eyeing his pair of chopsticks dubiously, “we haven’t been spotted yet. At first I kept thinking an alarm’s going to go off, but instead we’ve got the run of the place. I understand why the antivirus programs don’t know we’re there, since we aren’t in their database, but their other automated security programs ought to be spotting our presence. They continuously monitor operation commands and functions. If any company in the world understands how to mine data looking for the smallest hint of something unusual, it would be the Exchange—at least that’s what I thought.”

  “So far, we’ve only planted a bit of code, and that looks legitimate. All we’ve really done is take a look.” Jeff smiled. “And we’ve been clever.”

  Frank split the chopsticks apart, then tested them in his right hand. “They don’t know we’re there, so we can set up all the offshore accounts we want and move money into them. Of course, it would leave a trail, since computers are keeping tabs on the money, but there’d be nothing to stop us. The trick is leaving nothing behind that points to us personally, then whipsawing the money around the world until it’s impossible to trace.”

  “Do you really think that’s possible in this day and age? It seems to me that every digital transaction can be traced.”

  “In theory, sure, but if you’re clever about it, create a host of dead ends to mask the money trails, then bury all of them in complexity, you can slow such a search to a crawl. In practice, you can make it never ending. It would take a dedicated team and time, but it can be done. We saw terror groups doing that with the money they raised and stole all the time when I was with the Company. We did sometimes catch it, but we knew what we found was just the tip of the iceberg. The Internet, Jeff, is as close to infinite as anything on Earth. You don’t have to block anyone trying to trace you, even if it were possible; using robo code, you just have to keep stretching the trail ad infinitum. It works out to the same thing.”

  “Maybe. Better, though, if the Exchange never knew the money was taken in the first place.”

  Frank pursed his lips. “Yes, but how do you do that?”

  “Maybe take it directly from clients’ accounts, a bit here, a bit there, keeping in mind that a ‘bit’ in this case is a few hundred thousand, maybe a million at a time. Take a penny of every dollar out of transactions, for example. They might not even notice, and even if a client sees the loss, the Exchange doesn’t.”

  “But if enough of them complain, the Exchange will get on it.”

  “You conceal the loss within their trading patterns so it doesn’t look as if it’s an Exchange issue. You know bureaucrats, always looking to avoid problems if they can. If you aren’t greedy, all you’re doing is skimming a bit of the cream each time. It might raise a few eyebrows, but there’s no reason—in theory, at least—to cause any serious research. I think that’s the better way to do it. Then you can bury it with electronic false trails like you say. And it’s really only a variation of what the high-frequency traders are already doing, especially those hiding offshore.”

  “Good thing we’re honest.” Frank jabbed at his rice with chopsticks. He finally put them down and picked up a fork. “You know,” he said, “I’m thinking about moving my nest egg out of stocks.”

  “Why’s that?”

  “I don’t like a lot of what I’ve seen, but it’s these high-frequency traders that really get me.”

  “What about them?”

  “I don’t care if a company finds a way to buy and sell faster. Paying for close physical access isn’t fair, but those with money always have an edge like that. The problem with high-frequency traders is their manipulation of the financial system. And because they’re allowed to hide what they do, no one really knows the extent of the manipulation.”

  “I didn’t know you were such an expert.”

  “I’m not, but I’m getting there. Actually, I’m reading a book about it. It’s really eye opening.”

  “You’re obviously not working hard enough if you have time to read a book.”

  “It’s part of research. A vital part, from what I’m seeing.”

  The problem, Jeff and Frank had realized from the beginning, was that understanding in detail how the Exchange worked was extraordinarily complicated. The professionals making their fortunes from Wall Street employed their own jargon, in part to convey ideas effectively but also to safeguard their propriety access to the lucrative trading system. Once stripped of the needless complexity, the system wasn’t that incomprehensible.

  “Buy low, sell high” was still the lifeblood of trading. Computers and their role in the international market had caused that basic rule to become more complicated than ever, but it remained the essence of the Exchange. When someone wanted to sell, they offered the stock at a specific price. When someone wanted to buy, they listed the price they were willing to pay. Between them was a difference. When one party moved, the transaction took place, not physically off to the side of the trading pit as had occurred at one time, but with nearly unimaginable speed.

  Algorithms zipped through the Exchange’s computers, searching for deals within the parameters the programmers had established. When a trade that fulfilled the parameters was found, it was made faster than the blink of an eye, with no human interaction.

  The essence of this had always been to stand at the front of the line because there were always more buyers for deals at the right price than there were sellers. The logic was simple enough: More buyers at the listed price drove the price up. The stock available at a desirable price was gone before all the buyers were satisfied. Since getting to the front of the line was essential, the Exchange had a rule—the first to offer to buy was placed ahead of those to follow.

  As there was more than one exchange in the world, stocks could be offered
for sale or to buy at different prices at the same time. But like water seeking its own level, given time, every stock had but one price. The opportunity came when a delay existed in settling on that common price. In a process known as arbitrage, computers networked around the world reported differences in prices, and algos exploited discrepancies the instant they were discovered. HFTs made money if the difference was an increase in price, and most of them made money by short selling—that is, making money if the price fell. The difference was exploitable either way.

  Those opportunities had always existed, but now with computers, they were hunted down as never before, and the chain of transactions took place at unbelievable speeds. This was the red meat for high-frequency traders and as a consequence accounted for a substantial majority of all trading activity, a percentage that grew with each passing month.

  HFTs designed and unleashed more sophisticated programs than other trading systems. They paid for proximity to the Exchange’s hub engines to get themselves to the head of the line, beating out more remote competitors. They also possessed a comprehensive understanding of the market’s microstructure. No other traders understood exactly how the trading engines worked, precisely how trades were executed, how orders were prioritized—but HTFs did.

  “I don’t know,” Frank said as they finished their meal. “It just seems to me that the stock market doesn’t work any longer, not in any logical way. It’s so complex and fragmented, no one’s got a clear understanding of how it functions. It doesn’t even seem to be about providing a marketplace where people can buy and sell securities. There’s all this other stuff going on all the time. It’s all smoke and mirrors, altered reality, like a video game. What’s scary is that I don’t think anyone understands all the new rules or the full extent and implications of this permissiveness. There used to be just a few kinds of trades and only a couple of places to make them. Now there are more than one hundred types of trades, and if you add the variations, it’s well over that. And there are plenty of places where you can execute them. It’s all intentionally complicated, if you ask me.”