The airport was busy. Planes landed and took off every few minutes. Hordes of travelers moved about, usually in waves going one direction or another, pulling luggage behind them, wearing backpacks, texting and talking on their phones as they went. Not for the first time, he stared in amazement at the clothes people chose to wear on airplanes. The businessmen and women were obvious enough and there were a large number in cargo pants, comfortable walking shoes, and polo shirts. But the others … He had vague memories from his childhood when people dressed up to take a flight because such occasions were special and everyone wanted to look their best. Now the clothes looked pulled from a charity bin.
Seeing Daryl again had been both wonderful and awkward. He’d been relieved to see her looking good. He realized that he’d been worried about her but saw she’d flourished away from him. San Francisco apparently suited her. He’d considered embracing her as a longtime friend, but he’d hesitated, not sure the gesture would be welcome, and by then the moment had passed. From there on the personal aspect of seeing each other went downhill.
Daryl had talked mostly to Frank, only occasionally looking at him. Her departure had been as awkward for him as her arrival. So in the end, he was left with the work she’d done and with that he was very satisfied.
“Jeff! Jeff Aiken!” someone called.
Jeff looked up and spotted a woman in her fifties smiling as she walked up to him. Agnes Capps was wearing her distinctive purple glasses and was dressed in flamboyant Gypsy style, a mauve scarf wrapped about her neck with a flourish. She was a writer who late in life had carved out a niche for herself reporting and speaking on cybersecurity issues. Though not generally well regarded by computer security experts, as she tended to gloss over details and occasionally got things wrong, she was popular with various news shows. She produced a weekly article and a book nearly every year.
“My word,” Agnes said, “imagine running into you here of all places.” She sat beside him, a bit winded from her rush over. “Where are you off to? Or are you just coming back?”
Jeff had last seen Agnes the year before at CyberCon in San Diego. She’d been on one of the discussion panels. It had been unique in that the hacktivist group Anonymous had joined remotely.
Jeff didn’t want to lie, but then, he was traveling under a false identity. “Where are you off to?” he asked, answering her with a question of his own.
“Back home to beautiful Oklahoma City, if a tornado hasn’t flattened the homestead. I’ve been doing some research here. You would be shocked at what the U.S. government is secretly doing with all this social networking information people put out there so casually. It’s like Brave New World or 1984, one of those books. They know everything about us—absolutely everything—and they don’t even have to listen in to our telephone calls.”
“I doubt much would surprise me,” he said. “They have the ability to collect it and from their perspective, why not? They’ve got a country to keep safe.”
She snorted. “That’s what they say but it’s not true, believe me. You know,” she whispered, “I think that kind of information was used to influence that last presidential election. That’s why the polls were so far off.” She looked around to check that no one was listening. “I can prove the government used mass fake social networking accounts in the campaign, coordinated across Facebook, Toptical, and Twitter, and that they planted online articles to influence public opinion. They softened public outrage against the IRS, NSA, and other scandals with those same tactics.” She moved even closer, her body touching Jeff’s, and with her lips nearly touching his ear said, “If the truth were known, it would come out that the NSA is engaging in wholesale securities fraud to fund government black budget projects. They’ve been at it for years.”
What to say? “It wouldn’t surprise me a bit.”
“So … where are you off to?”
“Just coming back. Going home.”
“Ah, well, that’s always nice, isn’t it? And how is the lovely Daryl? I’ve not seen her in ages.”
“Good.” He hesitated. “But we’re not together anymore.”
Agnes raised her eyebrows. “She’s a keeper, young man. You can take it from me. Don’t let her get away.” She glanced at her watch. “I must be off.” She stood. “See you soon.”
Jeff watched her walk away with a wave of relief.
“Agnes is looking good,” Frank said as he joined him. “I thought I’d wait until she left. Did you mention me?”
“No. I told her I was on my way to D.C.”
“Good. Keep it simple, logical. What say we check into international departures and get that out of the way?”
They took their carry-ons with them and entered the security checkpoint. Jeff held his breath as the heavyset woman accepted his passport, scanned it, looked at the screen for several seconds, then handed it back. He moved on, placed his laptop into a container, shoes and belt, wallet, keys and change into another. The alarm sounded when he went through the machine, and a stoic man had him pass through again, this time without incident. Jeff recovered his items and sat down to put his shoes back on.
“So far, so good,” he said as Frank sat beside him.
“Don’t think about it.”
The pair walked down the long hallway to their departure lounge. Two hours later, they boarded. Another woman looked at his passport, matched it to his boarding pass, then let him on. Jeff didn’t breathe easy until they were in the air.
Now all he had to worry about was clearing immigration in São Paulo.
48
HOLIDAY INN
LAFAYETTE STREET
NEW YORK CITY
8:26 P.M.
Though her part of the operation was to follow the money, Daryl instead turned her attention to the code itself. She reasoned that Jeff and Frank had been in motion since the previous day, and she knew they’d had little if any time to work on the rogue code.
Frank had sent her a summary of their findings and suspicions before the pair left. She’d spent late Saturday night reviewing the code and tinkering with the malware. Now all day Sunday, she’d devoted herself again to the task.
She’d reached some conclusions, which to her seemed self-evident. She’d traced the stolen money to the bank accounts through which it was routed. According to Frank’s report, they’d decided that the money originated from outside traders, not from accounts within the Exchange itself.
This made a great deal of sense to her. If they were taking money from within the trading software of the Exchange, then security would easily discover it. But if they took the money from someone making a trade, then routed it through the Exchange, they could diffuse suspicion to any number of targets. And since none of the thieves were part of the NYSE, it would not be of concern to its ongoing security efforts.
So just as the money was dispersed into hundreds of bank accounts so too was it likely taken from a vast array of traders and brokers. As she worked the heavily obfuscated code in the malware she eventually located a store of IDs and what appeared to be trade amounts. She looked through the documents Jeff and Frank had gathered, remembering that one was a spreadsheet that listed the IDs the Exchange assigned to stocks. Sure enough, the IDs in the malware matched the ones in the spreadsheet. Attached to them as well were other symbols but a bit of research revealed them to be prefix designations to identify the type of trading vehicle.
One of the symbols was that for Toptical, TPTC. That was no surprise. Now that it was about to be publicly traded, it needed one—and starting Wednesday, it was going to be a heavily traded stock, at least initially. Its presence within the malware told her that the IPO was going to be a target.
As she knew little about them, Daryl researched IPOs to see what prior experience said on the subject. Major IPOs, she learned, created enormous volatility in the market during the first few hours. This occurred because there was pent-up demand by those who used the product, which in cases like this one represented millions of people
. Toptical was enormously popular and a great number of the faithful users were going to want to own a piece of the action.
Another reason was that the public generally had a positive opinion of IPOs. There was the undeserved belief that they were always successful and that those who got on board early did very well. There were plenty of public offerings to testify against that opinion, but for some reason, that reality didn’t capture the public consciousness.
Then there was the host of brokers representing hundreds of thousands if not millions of clients. Public offerings were always a part of their portfolios and in this case they’d be under pressure to take part. There were as well hedge and retirement funds, enormous piles of cash looking to diversify under favorable conditions.
There were also speculators, individuals and traders who believed they understood the market better than most and were persuaded they saw an opportunity. Some of them would buy early and if a specific price point was reached late Wednesday, they’d sell, looking to make their money quick and easy. Others would gamble that the stock was overpriced. They would sell short and make their money during the price collapse.
Finally, there were the high-frequency traders, some of which fronted those big piles of cash. The difference with them was their ability to incrementally manipulate the price, then exploit the conditions they’d created. They were seen as major factors in previous IPOs, and they relentlessly expanded their algos, tweaking their systems for each new opportunity. They could make money on the rise, on the fall, and on the thousands of variations in price in the meanwhile. They would have enormous influence on the IPO, especially in establishing a perceived level of trade volume.
What concerned her was that Jeff and Frank had already concluded that the rogue code was itself a high-frequency trader and whoever was behind it had gone to a lot of trouble to get the two of them out of the way. The only conclusion she could take from that was that they’d been too close. The malware wasn’t just any high-frequency trader; it was a trader without a monetary reserve. In other words, it had no backing. In the real world it could be said that in many, if not most, cases it made its play by some form of cheating.
Looking at the data dumps that Jeff and Frank’s code had funneled out of the engine to her C2 servers via the backdoor, Daryl observed the code had been updated twice since the Exchange had loaded its new IPO software and updated its trading platform code. Now TPTC seemed to be interlaced everywhere within it. A third update that afternoon disclosed it as the rogue code’s primary target, the numbers controlling the size and frequency of the trading skims representing as much as half of all the projected rogue code action.
How much would that be? she wondered. What she saw convinced her it was more than a billion dollars.
She turned her attention to the malware’s trading logic, carefully stepping through it and following the numbers flow across it and into functions that were obviously its connections with the actual NYSE trading engine. After several hours, she decided that she could make an estimate of how much money it had siphoned out of legitimate trades in the last year, $50 to $100 million.
Employing this information as a baseline, she now tried to determine how much action the latest code and configuration were designed for when it came to Toptical. She knew her best estimate would be inexact, that it had to be inexact because even those who wrote the algo didn’t know with precision how many opportunities it would encounter on IPO day. But even an imprecise estimate was better than a guess.
Seven to fifteen billion dollars. That was the potential spread.
Daryl was staggered. She double-, then triple-checked her analysis, but the results didn’t change. Hadn’t one of the significant problems with the market been caused by a much smaller trade? After a few minutes, she found it. On a day in which total volume was $200 billion, the Flash Crash had been caused by a trade of just $4 billion.
She wrote up a report of her findings to the “boys,” as she thought of them, concluding, “I’m no expert, but if these guys are looking to take seven to fifteen billion Wednesday, that is going to cause a great deal of economic trouble. And if there is a problem with the rogue code, or with HFTs or with the NYSE’s new trading software, we could be looking at a disaster worse than 1929. These exchanges worldwide are so interlinked that a multibillion-dollar scam of this sort could be the catalyst for truly terrible events. Look at what that harmless bot has done to the market. There’s another editorial in the NYT today attacking security at the Exchange. The market is expected to fall even more tomorrow because of lost confidence. If Wednesday is a disaster, I don’t even want to think what the consequences will be. We need to stop this!”
Daryl stepped away from her laptop and prepared for bed, scrubbing her face, combing out her hair, brushing her teeth. She was tired but knew she could still put in several hours yet. Back at the desk she connected to one of the C2 servers and looked for a new data dump from the engine, but found none. She checked and saw that the jump server backdoor was not in the logs. They had either been discovered and shut down, or some change in the Exchange’s security configuration was blocking their outbound access.
Her shoulders sank as the reality set in. They were cut off from access into the Exchange beyond the jump server, with no access to the rogue code or chance to trace it back to whoever was planting it. She tried again. No luck. After sitting for several long minutes in shock and dismay, she composed herself and sent another message to Jeff and Frank. “Beacon is down on the backside.”
Daryl stood up. What to do? How much more could she learn on a computer? How much could she expect to accomplish from her hotel room? Where could she best spend the next day?
She undressed, then climbed into the shower, soaping head to foot, scrubbing herself clean as she emptied her mind. Outside the shower as she toweled off it came to her.
Plan B. Boots on the ground and all that. There wasn’t much time. Still …
She was humming as she set her alarm and crawled between the sheets.
DAY EIGHT
MONDAY, SEPTEMBER 17
HIGH-FREQUENCY TRADERS POISED TO EXPLOIT TOPTICAL IPO
By Arnie Willoughby
September 17
As the next major IPO approaches, high-frequency traders are gearing up for what promises to be an eventful and highly profitable day. “HFTs make real money on big trading days with plenty of volatility,” Shannon Woodruff, publisher of the highly regarded Woodruff Report, said in remarks earlier this week. “The Toptical IPO promises to provide both.”
High-frequency traders, or HFTs as they are more commonly known, earn enormous profits by exploiting small changes in stock valuation. They identify these changes before anyone else, then complete their trades at lightning speed. Backed by billions of dollars they are the 800-pound gorilla in the stock market and Woodruff says they are able to bully their way through traditional traders.
“With enough capital, the latest algos, and proximity hosting, HFTs have a disproportionate advantage over everyone else,” Woodruff said. “The NYSE regulators are moving too slowly and too ineffectually to rein them in.” The price investors pay because of their dominate place in trading is a higher cost for the securities they buy, or reduced earnings for those they sell. “The HFTs scoop up the difference even though they serve no meaningful role in public trading,” Woodruff observed. “They are the three-card monte game of the stock market.”
High-frequency traders have been with us since the beginning of programmed computer trading. The advantages computers brought with their incredible speed and the ability to handle enormous volumes of data were recognized from the start. HFTs are always one step ahead of regulators in their latest exploits. “Despite recent changes in law the SEC essentially cleans up after them,” Woodruff said. “They give the illusion the HFTs are under control, but they are not. It’s the Wild West out there, and IPOs are the major shootouts.”
Though HFTs prefer to remain under the radar, it is b
ecoming increasingly difficult for them to remain out of sight as they now account for the overwhelming majority of all security trades. While the Toptical IPO is officially being downplayed as just one more major public offering, unofficially key investors believe it has the potential of being the largest IPO in world history. “Investors are eager for the next big thing, and their desire may well be a self-fulfilling prophecy,” Woodruff said. “If that is true, we could be headed for disaster. The HFTs have never been greedier. They know heavier regulation is inevitable at some point. This may be their last shot at a big killing.”
He cautions that increasingly HFTs behave in unison and that could spell trouble in the wrong circumstances. We’ll find out Wednesday.
READ MORE: HIGH-FREQUENCY TRADING, NYSE, TOPTICAL IPO
US Computer News, Inc.
49
CHARLES STREET
GREENWICH VILLAGE
NEW YORK CITY
9:13 A.M.
Richard Iyers leaned back in his chair and considered the weekend with distaste. Bored Saturday night, he’d gone to the Union Jack where he’d been pleased to spot the blonde he’d had his eye on for several weeks. She was even mildly intoxicated and in a playful mood, which made everything he had in mind that much easier. She’d seen him there before, and he had no trouble striking up a conversation. She was with a brunette girlfriend who was playing darts.
Iyers was his engaging best, and shortly after midnight, the pair had stumbled out of the bar and taken a taxi to his apartment. The rest had been by the numbers, and while in his view there was no such thing as bad sex, this had been a near thing. First and inexplicably, she’d wanted to be coy. After that, she’d wanted to be coaxed. He’d played her game, more than a little disgusted by it and with himself. Then it turned out that she had no imagination and was easily put off by almost everything he wanted. Worse, she didn’t like it rough, getting angry at one point, and the last thing he wanted right now was trouble, so he’d reined it in and settled for the ride. Disappointing was the word for it, especially when he realized—too late—that she wasn’t a natural blonde.
Rogue Code Page 25