Slashdot Mirror
Pentagon Turns To High-Speed Traders To Fortify Markets Against Cyberattack (wsj.com)
Slashdot reader Templer421 quotes the Wall Street Journal's report [non-paywalled version here] on DARPA's "Financial Markets Vulnerabilities Project":
Dozens of high-speed traders and others from Wall Street are helping the Pentagon study how hackers could unleash chaos in the U.S. financial system. The Department of Defense's research arm over the past year and a half has consulted executives at high-frequency trading firms and quantitative hedge funds, and people from exchanges and other financial companies, participants in the discussions said. Officials described the effort as an early-stage pilot project aimed at identifying market vulnerabilities... Participants described meetings as informal sessions in which attendees brainstorm about how hackers might try to bring down U.S. markets, then rank the ideas by feasibility.
Among the potential scenarios: Hackers could cripple a widely used payroll system; they could inject false information into stock-data feeds, sending trading algorithms out of whack; or they could flood the stock market with fake sell orders and trigger a market crash... "We started thinking a couple years ago what it would be like if a malicious actor wanted to cause havoc on our financial markets," said Wade Shen, who researched artificial intelligence at the Massachusetts Institute of Technology before joining Darpa as a program manager in 2014.
Among the potential scenarios: Hackers could cripple a widely used payroll system; they could inject false information into stock-data feeds, sending trading algorithms out of whack; or they could flood the stock market with fake sell orders and trigger a market crash... "We started thinking a couple years ago what it would be like if a malicious actor wanted to cause havoc on our financial markets," said Wade Shen, who researched artificial intelligence at the Massachusetts Institute of Technology before joining Darpa as a program manager in 2014.
Dedicated backend links with DoS mitigation, elimination of high frequency trading, moving instead to an x second or x minute tick with all incoming orders either randomly assigned service order, or organized by buy/sell price, to help mitigate timing based attacks?
The current system seems built for cheating/gaming the system, so rather than trying to solve a social/legal problem with a technical solution, how about solving the underlying cause and scale back trade timing to human accessable values?
They should be looking for flaws in the algorithms. Impossible with neural nets.
The biggest weakness is a foreign entity gaining access to the brokerage accounts of a large trader and either:
a) executing a liquidate (sell everything NOW) order where billions of dollars of assets are suddenly flooded onto the market, resulting in algorithms at other trading houses doing the same (they all move in lock step with each other)
or
b) naked shorting a big stock like Apple or Google and thus causing Lehman Brothers type of events, whereby the assets are lost.
Once that money is lost, it doesn't come back. There is no insurance for a bank to be bailed out by in a bad trade.
The entire reason insurance companies like Geico exist is because they are backed by trading houses that have investments in a many other businesses. Like it's damn near impossible for Berkshire Hathaway to go bankrupt, because it doesn't merely own shares in a business, it owns large businesses. Thus it can pay out property insurance (it's mostly known for car insurance) without even blinking, as it makes as much money as writing off a new car every few seconds.
Given the parties involved in the financial meltdown of 2008, the irony and stupidity of looking to those on the inside to help "fortify markets", fucking kills me.
Congress hasn't done much to prevent another meltdown, so perhaps we should focus on the real threat. Greed N. Corruption is still in charge of Wall Street.
If people actually understood the stock market from the game theoretic point of view that it is designed as, they would see that no order can be placed to the detriment of any other actor's orders, and that in fact, every order either increases the value of the market to *some* set of actors in that market or at worse has no effect at all.
This, and the resulting analysis, is completely bogus.
For an analogy, consider a town with a market in the center. Farmers come from far away to sell their wares at the market.
There is risk in farming: a farmer might decide to plant corn one year, or some other crop. If everyone plants the same crop, there will be a glut and the prices will be low, but if the farmer plants one crop and no one else does, his reward will be very high.
There is need in buying. Someone who is hungry for goods will pay more than the asking price. "Hunger" here only means a general need, and not physical hunger: a father purchasing flowers for his daughter's wedding might be willing to spend more money to outbid other people who want flowers for a lesser need.
A farmer takes risks, and sometimes those risks pay off. The buyer has needs, and sometimes is willing to pay more to satisfy them. The buyer also sometimes gets a good deal.
We've all done that - found a motivated seller (or buyer) on eBay and gotten a good deal, right?
Now suppose there are runners who can ask the farmer what his selling price is when they reach the edge of town, and the father what his buying price for the goods are. The runners are very fast and can get a sense of what the prices are before either party gets to the center market.
Here's the outcome: the runners will put themselves in the middle of the transaction *only* if the buying price is higher than the selling price. If the selling price is too high, the runners won't bother.
The end result is farmer never gets an occasional boon from his risks, and the buyer never gets a sweet deal on his purchases.
The seller is forced to take risks, but will only ever see the average return. The purchaser will always pay full price, and will never see a random good deal. The end result is that both the buyer and the seller are discouraged from entering the market.
This is completely analogous to the principle of unequal knowledge, which is why used cars have no value: A buyer cannot easily tell whether a used car is any good (it's difficult to tell whether the engine or transmission will need repair, for instance) so will only pay average price for a used car. A seller with a good car won't sell it for average price, which brings down the average, which means owners won't sell mediocre cars for the (lower) average, and the cycle continues. The end result is that used cars have almost no value.
It's the same for high-speed trading, using risk instead of knowledge. If making a product takes risk but you can't recoup any value from taking the risk - then you won't take the risk.
For both the seller and the purchaser, the market has reduced in value because of the runners.
Don't buy into the hype - it's only people making a lot of money off of "a good thing" trying to pull the wool over your eyes.
We have bureaucracies designed to fuck us over without regard to our civil rights, turning to bureaucracies designed to fuck us over financially, to "protect us".
Color me impressed. No, color me scared, cuz I see no way this is A Good Thing (TM) for me.
Who needs an attacker? The system already has high speed trading to poison itself.
Vulnerability is a fundamental property of houses built of cards. It's probably fair enough to expect those sitting atop the house of cards to know where some vulnerable cards are but you must equally expect that they will only identify those cards that do not affect their position in the house (This may be out of malice toward others atop the house... but you should not attribute malice to that which is adequately explained by ignorance or stupidity). I would be willing to wager that none of the high-speed traders consulted suggested that for a house to withstand a shock you don't build it with cards.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
Have gnu, will travel.
The US and presumably EVERY country have people that war game unlikely scenarios just to have a plan available.
How likely is it that the US would need to invade the UK? But there IS a plan for that.
Makes sense to have plans for computer attack scenarios AND to harden against them before that scenario happens.