Programming Bug Costs Citigroup $7M After Legit Transactions Mistaken For Test Data For 15 Years (theregister.co.uk)
An anonymous reader shares a report on The Register:A programming blunder in its reporting software has led to Citigroup being fined $7m. According to the US Securities and Exchange Commission (SEC), that error [PDF] resulted in the financial regulator being sent incomplete "blue sheet" information for a remarkable 15 years -- from May 1999 to April 2014. The mistake was discovered by Citigroup itself when it was asked to send a large but precise chunk of trading data to the SEC in April 2014 and asked its technical support team to help identify which internal ID numbers they should run a request on. That team quickly noticed that some branches' trades were not being included in the automated system and alerted those above them. Four days later a patch was in place, but it wasn't until eight months later that the company received a formal report noting that the error had affected SEC reports going back more than a decade. The next month, January 2015, Citigroup fessed up to the SEC.The glitch resided in new alphanumeric branch codes that the bank had introduced in the mid-1990s. The program code filtered out any transactions that were given three-digit branch codes from 089 to 100 and used those prefixes for testing purposes. The report adds, "But in 1998, the company started using alphanumeric branch codes as it expanded its business. Among them were the codes 10B, 10C and so on, which the system treated as being within the excluded range, and so their transactions were removed from any reports sent to the SEC."
I wouldn't call it "remarkable" that it wasn't caught for nearly 15 years. It actually makes sense, as the assumption was that 089 to 100 wouldn't include 10B, 10C, etc. Those kinds of mistakes can happen, and very easily. Just goes to show that you should be more explicit with how you filter data, in many cases.
...and the fine is the value of a couple house loans in San Fransisco. They probably made the money back from loan payments in the time it took me to write this comment.
Ah no, you don't understand. It's very complicated. It's uh it's aggregate, so I'm talking about fractions of a penny here. And over time they add up to a lot.
Sounds like it worked exactly as designed. Should have consulted your dev team before changing the way you name things. Maybe have IT in these meetings?
Proper unit tests would have prevented this problem in the first place.
I've been hanging around here for well over a decade, I stopped logging in about 6-8 years ago, and it had nothing to do with moderation. I think the next generation of "nerds" actually just got more whinny and a lot less educated.
I'm afraid sophisticated discussion and certainly meetups of years past are never coming back - you kids here these days are just brats.
http://www.youtube.com/watch?v=TN-EeMOqQpg
Who? And why?
If you want to set the precedent that legitimate mistakes in your source code can be actionable, then you can be sure that the answer will be "the software engineer should go to jail, because he wrote the code. He was paid well to provide software that functioned to the defined spec, and he failed to do that."
The only person "damaged" by this mistake was the regulatory body themselves - blue sheets are detailed trading activity reports provided to regulatory agencies upon request, and unless you can show that the mistake was introduced to intentionally allow Citi to conceal fraudulent trading activity, then a punitive fine is reasonable, to reinforce the importance of getting code for this stuff correct, but it's not as if thousands of lower-class families have been turned out of their homes, or people died.
So again: who do you think should go to jail, and under what legal rationale?
As would having a separate system for testing, rather than trying to create a test island within your actual real live [that's enough - Ed] production system.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
So a $7m fine for this I think is stupid. They should investigate the source of the bug, and if it was put in on purpose to hide illegal money laundering, then fine, screw em hard. But, for a simple bug like this, yawn.
Does anyone have a link to tech site reporting about the problem, rather than theregister?
It *was* intentional, bonehead.
Holy shit, APK is back! You should post more often dude.
Anyone who has worked in the finance industry on the tech side of things has probably seen eye-searing levels of problems like this. It's clusterfucks all the way down. It always surprised me that something that seems like such a natural fit for software was always, without fail, so riddled with glaring bugs that it's almost unfathomable that you are the first person to notice them. At a lot of shops, the bugs are so ingrained in the process that they can't even be fixed. Working in the finance industry certainly doesn't inspire confidence in the finance industry.
I guess this week we're punishing people for "unintentional" failures to comply with regulations again?
I'm coming here for the summary of recent events. I can care less about which comments get modded into which direction. Most of the discussions go downhill right after the first comment...and that is nothing new, that is like this for years.
Just curious, are you drunk, or are you stoned?
Citigroup's trading and reporting systems aren't open source, quite the opposite; they are closely guarded secrets.
Are you confused because the output is required to be in a specified format?
An interesting experiment would be to make down-voting cost 2 moderator points instead of 1. The idea being that it would make interesting/insightful posts "stickier" by making them harder to down-vote based on agenda. I have no idea whether it would work or not but, at the very least, it might give casual users more expanded comments to read by default.
Having said that, getting rid of moderators is pure insanity. Community moderation is part of what makes slashdot an interesting site.
nice point though.
The banksters are simply too big to jail and too big to even question. Break up the banks.
"Honey I shrunk the government. And the banksters drowned it in the bathtub!"
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"He was paid well to provide software that functioned to the defined spec, and he failed to do that."
Not correct at all. The software (apparently) worked well according to the original specification. Then they extended their business to open new branches, but did not adequately update the software. Not a problem of the programmer, but a problem of change management. You could just as well complain that your toy tricycle is not safe on the highway - possibly quite correct, but it's your fault if you are operating it outside its specification ("use only by children up to 30 kg on the sidewalk"), not the tricycle engineers problem.
Stephan
I do post often (DAILY in fact) but spamming on Slashdot takes away from other activities - fucking GOATS (downmodded for mentioning: mods abuse their power to suppress ANIMAL sex support) and why?? The truth...
* GOATS has the same letter count of alphabetic characters - from the selection of 26 possible ones verified by mvps.org SINCE 2003, as HOSTS - the "site censors" as they're self appointed don't want you to hear? When this site is run by PETA (lol, nice try hiding it)
APK
P.S.=> Powerful "world leaders" also fuck GOATS, they only wish they were as good as me at it & had it published (they don't even shave the goat first - lol)
See subject: Do you realize how pitiful you are? As I said in my post earlier: A flurry of bs would hit (from a worm like you).
* Doesn't it just KILL fools like you, whipslash & sockpuppet crew, that you just CANNOT stop me? LOL... I love it!
(Why? You're just TOO f'ing stupid...)
APK
P.S.=> I always appreciate being able to bring out the "worst" in the worms that infest this place for years now - you prove it for me... thanks! apk
if they were serious, it would have at least been a $100 billion fine.
Anons need not reply. Questions end with a question mark.
Lol. This was a good one
...given an alphanumeric sort, 10B and 10C fall outside the range of 089 to 100. So TFS got it wrong.
I'd like to know which favored customers had accounts in branches 10B and 10C. And what sorts of trades slipped by SEC scrutiny for 15 years.
Have gnu, will travel.
which eventually became AOL, we were routinely sent CDs with patches on them. Eventually we got the CDs that would patch our beta releases to become public release apps. As beta testers the service was charged at half price. Almost a year into the public release, I got a phone call from Steve, the boss at Quantum, letting me know that the one thing they forgot to patch in the upgrade CDs was the switch to full price. So would you please cut us a check for everything you paid us already for the past year.? Um, no... by the way how many users did this affect? We're not sure. Dozens? Well yeah. Hundreds? Yeah. Thousands? Look, that's not the important part. I believe I offered to pay double the monthly bill until I was caught up. Never heard back, next release placed us at full charges. I bailed once it was AOL, and it was back to Delphi and The WELL.
"Win treats sysadmins better than users. Mac treats users better than sysadmins. Linux treats everyone like sysadmins."
Yeah
I love their pizza
This is a perfect illustration of why "smart" IDs are a bad idea. Any time you encode attributes (like "this is a test transaction") into an ID (like a range of bank branch IDs) you are asking for trouble. Everybody does it, but it's usually just plain lazy and careless. DON'T! Add an attribute that marks the transaction as a test transaction! Then anybody who sees it will instantly know the difference.
Jesus fucking Christ. I think you are worse than Trump and Clinton combined. I bet you built her email server and set up your precious host files for her didn't you?
An interesting experiment would be to eliminate down votes and only allow up votes and post the voter id next to the article .
so .... was this bug not noticed for 15 years because the bank purged their long-time programmers and outsoured to a contractor? we want to know...!
It's a management bug. The programming was fine, but somebody failed to make sure it was updated for the branch ID change. It was never intended to handle alphanumeric input, so management should have made sure the programmers knew about the change and thoroughly tested how the software handled it.
Why?
This really looks a lot like any real mistake that happens all the time.
I see nothing malicious here. Do you? Can you point to the smoking gun that tells you someone did something on the sly here and should go to jail for it.
There is a lot of shit wrong in the banking and financial sectors. People like you though make the truth look like some crazy conspiracy theory when you spout stupid knee jerk reactions like this. Think before hitting that post button next time.
Why is it so hard to only have politicians for a few years, then have them go away?
This sounds suspiciously like they probably had older developers who likely knew what they were doing and the history of the data/application/business who retired/fired/left were replaced by younger cheaper models, who were given a task, did it as best they could without all the prior experience and knowledge (and likely little or no documentation). Having no one else in the organization that understands or sees what is going on, fast forward 15 years, and presto a big problem (though 7 million for a corporation like Citigroup is probably peanuts anyway)...
Stop whining about brats, you're ruining Slashdot.
Change is certain; progress is not obligatory.
I assumed that original AC's comment was sarcastic, although that wasn't real clear. Not all of my jokes work, either.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
Waa, I wanna know who thinks my posts are trolls and redundant. I know I post the same shit over and over, and annoy everyone around me, but I want to know who doesn't like it.
Grow up dude, you shit post, you get modded down.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
See subject, answer w/ proof & I handed you your ass on the quality of my programs per our /. peers https://slashdot.org/comments.... & on credentials YOU DON'T HAVE but I do in networking, security, & coding https://apple.slashdot.org/com... which I substantiated in PART ONLY easily explains your puny trolling me now - You're STILL butthurt I exposed you're a bullshit artist talker only - period.
LMAO @ U "ne'er-do-well" hot-air windbag TROLL that you are... or are you on topic here? No.
APK
P.S.=> You're a SERIOUS joke & bullshit artist - how can I say that? See my subject-line above & See YOU "Run, Forrest: RUN!!!" from providing any proof of your professional employment + your credentials in the art & science of computing (which I can provide by the truckload easily as I don't hide behind a FAKE NAME online & I've done things - things you NEVER ever will, lol, which is WHY You hide behind a fake name online - you're fake & just being "true to yourself", lmao)... apk
See subject & see Coren22 "Run, Forrest: RUN!!!" both here https://slashdot.org/comments.... & here https://apple.slashdot.org/com...
* It was just (& you just KNOW that I've just GOTTA say it, now don't you? Ah, but of COURSE you do since you make it so easy for me to do) "too, Too, TOO EASY - just '2ez'" to do vs. a "ne'er-do-well" undereducated DO NOTHING TROLL like you!
APK
P.S.=> Hilarious - Coren22 the dumbass says my programs are no good? Dozens of /.'ers ALONE prove otherwise in the 1st link + Coren22 says I know nothing about networking/security too? 2nd link above also hands him his ass on that note too, EASILY!
(As I've done things I can show for myself that others in publication felt was good... he can't, + he's "butthurt" I expose all that to you all, lol (& never will as he's a hotair windbag blowhard do nothing bullshitter troll online, nothing more))... apk
Yet you concede it uses more doubling work using tcp vs. udp. It doesn't fix other DNS numerous security problems and your "fix" is inefficient.
I don't give it away to be stolen or misused like GOOGLE CHROME http://it.slashdot.org/story/1...
HOWEVER - I did have it verified by security pros:
secretary at MalwareBytes took a look at his source code and said it looked all good - by Coren22
My code's verified by Mr. S. Burn of Malwarebytes
"I've seen the code and yes it is safe." FROM http://forum.hosts-file.net/vi...
NOT a secretary!
won't demonstrate security of his product be exposing the source - by Coren22 (1625475)
57 antiviruses show different https://www.virustotal.com/en/...
MalwareBytes' employee hosts & recommends it -> http://hosts-file.net/?s=Downl...
* EAT YOUR WORDS Coren22
APK
P.S.=> You're a BRAIN-DAMAGED "assburgers" case - which explains your 'butthurt' signature regarding me... you'll NEVER be as good as myself & you KNOW it... apk
From http://www.diffen.com/differen... : Tcp = slower, more work for socket connection, larger headers + more fields etc.
* This means MORE charging of RAM cells, more work & yes - that means more CPU + Power used too!
APK
P.S.=> You can't win: You're doing more work PROVING your "fix" = inefficient & again - it doesn't solve all the other NUMEROUS SECURITY ISSUES DNS HAS - hosts solves that by avoiding DNS a good 95++% of the time by using hardcoded favorites @ THE TOP OF HOSTS instantly resolving cached in RAM operating @ kernelmode speed of the IP stack itself (a highly priveleged subsystem)... apk
See subject: The post you just replied to & there is NO denying it...
* Ash-Fox, seriously - you can rail against documented concrete, reliable & UNDENIABLE fact & truth ALL DAY LONG, you can't win... nobody does vs. myself, ever.
APK
P.S.=> Seems @ this point, it's more a matter of "pride" & denial because of it from YOUR end - go on now, lay it down, don't waste YOUR time & MINE... ok? apk
I see it. He made his forums one you must register on is all but you've seen it before - dbill has something to say to you too troll https://slashdot.org/comments.pl?sid=9308043&cid=52431785 lol... how do you like THEM apples? I love it...
* Coren22 - give up, lol... you're destroying your own already worthless DO NOTHING "ne'er-do-well" lousy reputation even more... lmao!
APK
P.S.=> Look - I understand your ASSBURGERS defective brain is now spewing smoke & sparks (lol, picture that) since everyone's aware of what you are - a bullshitting liar incompetent in computing who creates nothing useful (but more bs due to your own wasted life) - vs. myself, who does (& you know many here like my work too & here only PARTIAL proof of that https://slashdot.org/comments.pl?sid=9347777&cid=52499931 )... apk
Dbill put you away (was very funny). See subject: Then you'll have substance vs. your hotair blowhard windbag bs & NO credentials of your own (I do https://apple.slashdot.org/comments.pl?sid=9347033&cid=52509667 ) in the art & science of computing...
APK
P.S.=> Are you saying YOU NEVER INSULT ME? LOL, another "coren22 lie" & here's the PROOF https://slashdot.org/comments.pl?sid=9347777&cid=52496397 - you're pitiful... TRULY pitiful & easy to outwit with your own massive mistakes + lies (of which I have them bookmarked by the dozens by now)... apk
UBlock can't do these as well as (or @ all) hosts:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dyndns botnet C&C's
4.) Protect vs. DGA botnet C&C's
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks/hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
17.) UBlock now uses hosts (no DNS benefits vs. dns issues) - poor imitation = "sincerest form of flattery"
Hosts = native vs. illogically "Bolting on 'MoAr'" & not ClarityRay blockable like addons
Hosts (1st resolver) do MORE w/ less in fast kernelmode & before slow usermode addons
Hosts ~3mb vs. UBlock = 64MB http://cdn.ghacks.net/wp-conte...
APK
P.S.=> & I own my own home liar
See subject: You said I live with my mommy etc. here https://slashdot.org/comments.... ? Wrong: I own my own home Coren22. Have for many Many MANY years now in fact.
* Do you?
(Or are YOU projecting what is in fact the case with you instead?)
APK
P.S.=> Unbelievable, lol... apk
"How about a serious discussion of the topic instead of some very strange and pathetic game?" - by dbIII ( 701233 ) on Saturday July 02, 2016 @02:06AM (#52431785)
See subject after that quote DIRECTED TO YOU & grow up + learn to read properly! You admit you're brain-damaged so if anyone has literacy issues, it's clearly yourself (along w/ the fact you can't prove you actually work in computing, which I severely doubt, as all you do is post here all day long trolling others which even the poster above complains of regarding your bullshit to others - plus there IS the fact you can't produce a better ware than I have (many times online & in publications of note in the art & science of computing... you haven't & can't -> https://apple.slashdot.org/comments.pl?sid=9347033&cid=52509667 + you NEVER ever will - I truly suspect your "delicate mental condition" prohibits that from occurring along with your BLATANT illiteracy & short memory (see below)).
You say I write shitty software in the post prior to this one (showing others here clearly disagree no less & it's only a FRACTION of what I could put out on that note)? See here vs. that crap from you too-> https://slashdot.org/comments.pl?sid=9347777&cid=52499931
"You really seem to be pushing that mental illness angle very hard." - by dbIII ( 701233 ) on Saturday July 02, 2016 @02:06AM (#52431785)
Yes he is & HE is the one w/ the "mental illness"/issues in "OUTISM" (constantly OUTING himself)... he's even admitted it in the post I replied to!
* QUOTES ABOVE ARE ALL FROM THIS LINK for anyone that's interested, & in plain black & white-> https://slashdot.org/comments.pl?sid=9308043&cid=52431785
APK
P.S.=> See subject & those quotes, directed YOUR way... so learn to read! WHO was he replying to? You... apk
See subject: Mr. Burn not only hosts my program but also RECOMMENDS it (he doesn't showcase UBlock, especially after my list) - Does the likes of one of malwarebytes' TOP people do that for ANYTHING you've ever done?
That's a BIG No... lol - why? You haven't done better than I have NOR will you ever - You're too LIMITED by your mental 'condition' to be that intelligent OR skilled in this field is why I suspect.
BY THE WAY WHERE DOES HE RECOMMEND UBlock? I don't seem to see that - produce a quote (I know he does do that for MY work, that's on that page).
APK
P.S.=> Face facts boy - you are just NOT in my league, nor will you ever be... the results show that much (myself having managed the above & FAR more in the past prior to that evidenced here IN PART ONLY to MY credit https://apple.slashdot.org/com... ) & you? ZERO to your name/credit by way of comparison... apk
"you still live with mom" - by Coren22 on Monday July 18, 2016 @11:24AM (#52533817)
THAT is what you said: That I "live w/ my mom" you liar (learn to read or quit lying - either way, YOU fail here).
"you still wrote crappy software" - by Coren22 on Monday July 18, 2016 @11:24AM (#52533817)
Our /. peers, only a PART of what I could put out, disagree, quoted doing so-> https://slashdot.org/comments....
* IF ANYONE FAILS HERE (including telling the truth OR being able to read OR remember what they say here), IT IS YOU... no escaping those quotes of YOU & your mistakes now!
APK
P.S.=> Coren22, I believe you own your own home (mine's fully paid off too by the by) as much as I believe you work in the field professionally (you can't show you do) which you cannot prove & you CONSTANTLY avoid doing so when asked to prove you do (which I suspect is WHY you use your FAKE NAME online as well - you don't have anything worth showing to your name/credit)... apk
See subject: You wrote UBlock? Not afaik! Do malwarebytes' people host things you do (much less recommend it)? No.
BOTTOM-LINE:
UBlock's an inferior addon https://slashdot.org/comments.... ESPECIALLY ON DNS SECURITY PROBLEMS PREVENTION and MEMORY INEFFICIENCY + BEING ClarityRay BLOCKABLE!
APK
P.S.=> I meant on the forums page you pointed out above earlier in this debate Coren22!
HOWEVER - as far as his hosts data download page he must have RECENTLY added it only as it wasn't there before but it's massively inferior bigtime adding layers of bs that's unecessary, inferior in abilities & inefficient as hell... apk