[FoRK] How to lose $7.2bn with just a few Basic skills

Eugen Leitl <eugen at leitl.org> on Thu Jan 31 08:14:33 PST 2008

http://www.theregister.co.uk/2008/01/31/kerviel/print.html

How to lose $7.2bn with just a few Basic skills

By Dominic Connor

Published Thursday 31st January 2008 12:01 GMT

Special report As I swept through Kent and Calais on a Eurostar last week,
the financial markets again threw some entertainment my way in the shape of
the SocGen debacle.

My last Reg piece
(http://www.regdeveloper.co.uk/2008/01/21/vba_office_victory/) explained that
the credit crunch
(http://www.theregister.co.uk/2007/09/07/derivative_modelling/) was partly
fuelled by VBA and that is what appears to have happened again.

However, Eurostar trains don't have Wi-Fi, and my only access to the world
was a BlackBerry. So getting Kerviel's number took hours, by which time he
had gone to ground. He has my mobile number if he wants a chat...

Nevertheless, in various Paris bars over the weekend, fragments of the story
grew in the telling. There were a few common threads, but the consensus was
not surprise that this had happened - just that it happened to SocGen, which
has an enviable reputation throughout the market as a "smart" bank.

Absolutely no trader or quant has said to me "couldn't happen at my bank". A
couple of sharp risk managers correctly speculated that the numbers involved
would grow, and that because he had compromised the systems no honest final
number would be available soon. Since it appears that it was an external
source who complained about the problem, not SG risk management, this seems
highly credible.

SG say it is going to sue Kerviel, but according to the lawyer I was
travelling with, this could be a six year case if he makes a fight of it. His
low rank meant that none of the traders seemed to know him personally,
implying that the great bank had been bitten hard by a junior henchman, and
he had dug himself in a hole in an attempt to claw himself up from a 75K
entry level package.

Most of the media have yet to pick up on the fact that he was supposed to be
an arbitrageur, someone who makes riskless profits by spotting things that
have been given the wrong price. Instead he bet on prices going up and down.
One idea that caused much merriment late Saturday on the Ile Saint-Louis is
that his work was deemed to be so low-risk that no one looked all that hard
at it.

Oh how we laughed.

Another reassuringly expensive lawyer held the underyling cause to be the
"tick box" mentality, whereby every bank produces a thick "compliance manual"
which no one ever reads; part of a process where people do what they are told
rather than think.  Market Impact

More than one person pointed out that SocGen were likely to lose money just
to get out of this mess, as banks spend good money on "market impact models";
confections of hard maths that try to avoid your bidding up prices against
yourself. Also, they would be forced to offload regardless of market
conditions, so this may end up more expensive than the original foulup.  Qui
est cet homme?

No less a figure than the President of the Bank of France called M. Kerviel a
"computer genius", which is frankly just about as silly as M. Noyer's
apparently blind acceptance of the lines fed to him by SocGen. One can only
speculate on what else he has swallowed in this matter. SG's CEO Daniel
Bouton referred to Kerviel as a "mutating virus", to bolster the notion of a
hi-tech attack by the love child of Lex Luthor and Bill Gates.

But I headhunt people for the high end of banking, and Kerviel's CV
(http://www.telegraph.co.uk/money/graphics/2008/01/24/bcnjerome125big.gif) is
not that of a BOFH. We have quite literally hundreds of PhDs on our books
from quantum physics through exotic mathematics, incomprehensible dealings in
game theory, and bleeding edge programming in F#, to cruel and unusual C++. A
few have made serious money out of poker. Some are fighter pilots. In this
field a bit of VBA does not impress.

But I can infer he was a superior tactical programmer because he was promoted
out of the wilderness, which implies he can work hard, and so commands some
respect. He might have downloaded some scareware, but the idea that he did
any hardcore hacking seems like a fanciful attempt to make SG look less
negligent. No one would blame a bank that was raided by heavily-armed special
forces, but SG was in effect taken by the man who mends their guns.  Je pense
que...

I used to be head of IT at a city firm, was director in charge of the British
government's secure network to monitor investment banks, and have done time
as a tactical developer in several banks, but not SocGen. So the rest of this
piece is inference spiced with direct personal communications as a headhunter
with people who discreetly shared unattributable insights over fine wine or
shouted them across mediocre lager. Short version: This is informed
guesswork.

There have been the inevitable articles on "warning signs" that should have
been spotted, and it's hard to argue with that. But to put that into context,
everyone who has worked in trading firms has seen position reports that imply
that you've accidentally bought up Microsoft, swapping it for your stake in
SCO and an option to buy a goat.

Kerviel could explain these signals away because he had worked in the mid
office responsible for risk management. When asked why he apparently had a
huge position, he would easily have been able to say "sorry, when we built
that report, we got it wrong in the way we handle failed trades", and maybe
even offer to fix it. For a given value of "fix", of course. Certainly he
would have enough excuses to get over the head of a manager chosen on the
golf course (you know who you are).  How many passwords would you like M.
Kerviel?

SG's official statement claims he stole passwords, but this is highly
unlikely to be entirely true. As a mid-office developer he'd be freely given
a pile of passwords and access rights. I would actually be quite surprised if
all of these were taken away when he was promoted; and as for the passwords
of his colleagues, they are shared far more often than the security policy of
any bank would permit. I have seen junior staff on trading floors told to log
on as other people (no, I'm not saying where, but it's common). The way it
works at most firms is that as his new job required more access, this would
have been added to his profile, but no one would have asked whether he should
be taken off the mid-office servers.

Many organisations deal with "permission creep" by randomly deleting access
every year or so, and waiting for people to complain (yes really, it's not
just your firm, happened to me more than once). But a common bad technique is
to embed usernames and passwords into applications, especially Excel report
sheets. These tend to be powerful administrator or developer accounts,
granting unlimited access with little or no auditing. I have seen what
happens when these accounts are deleted without asking the developer, and it
is not pretty. Who, me? Would I do such a thing?

Of course this rarely happens to "important" people, and the food chain at
most investment banks has even junior traders like Kerviel in the top tier,
so I'd bet money no one even asked why he still had the old access rights.
Realistically, being able to do extra useful things and sort out problems
with "lower" areas would have made him a more valued member of the trading
team, so anyone trying to take his access away would therefore have had a
fight on their hands. Such is the menial position of IT in most firms, most
would not even try.

Assuming all of this, there are several classical ways he could have hidden
what he was up to armed only with VBA, Walkenbach
(http://books.global-investor.com/books/23480.htm?ginPtrCode=10202) and the
right passwords. Marking trades as having been done by someone else is the
most obvious, yet not entirely trivial to stop. A critical requirement of
trading systems is to allow others to handle your position when you are off
sick or on holiday, creating a set of vulnerabilities. My information is that
he may have exploited this, and avoided being away from the office in a way
quite atypical for French workers
(http://www.thedailymash.co.uk/news/business/french-trader-was-forced-to-work-30-hours-a-week-2008
banks, they may have missed it. However, it defies belief that they'd allow a
position of this size by a junior trader, unless the systems were feeding
them bogus numbers.

It is possible that he "upgraded" the report spreadsheets that would have
caught him, since at most firms they are not secured, and can be changed by
anyone in the department. Often this just results in ghastly errors
(http://www.eusprig.org/#DOWNLOADS) , but they can be used for darker deeds.
Some banks use products like Xenomorph (http://www.xenomorph.com/) to seal
and manage spreadsheets, but most just hope for the best.

His VBA skills would have helped him a lot to keep the illusion alive.
Traders hit spreadsheet problems so hard that I've helped a couple of banks
build teams of thick-skinned Excel jockeys who can hack them into shape in
real time under pressure - but most banks do not have these, so you have
untrained people helping each other. Knowing Excel, he would have been asked
to sort out his colleagues' spreadsheets, and left sitting at their PCs able
to execute any number of misdeeds while his colleague went off for lunch.
That covers the claims that he intercepted emails and carried out all sorts
of technomancy on the risk systems without using a network sniffer or hacking
the Windows kernel.  Could it happen here ?

France and Britain represent the opposite poles of regulation. Under EU
tutelage Paris passes market laws which are policed "politically", i.e. not
on important French companies, while the British FSA applies gold-plated
regulations with a staff so underpaid that they can't hire the right level of
people. But the technology and business logic is identical in London, NY, and
Paris - so of course it is in no way limited to the French way of banking. ®

Related stories

Low-tech hack was behind $7.2bn SocGen fraud (30 January 2008)

http://www.theregister.co.uk/2008/01/30/socgen_hack/

Ingram Micro slams credit crunch 'negative thinking' (30 January 2008)

http://www.channelregister.co.uk/2008/01/30/ingram_micro_credit/

Tighter controls likely after SocGen debacle (28 January 2008)

http://www.theregister.co.uk/2008/01/28/sogen_regulation/

Rogue trader blows sox off controcbi_credit_crunch/

Credit crunch cranks up pain for SMBs (17 December 2007)

http://www.theregister.co.uk/2007/12/17/smb_economic_outlook_cbi_2008/



More information about the FoRK mailing list