The Feds’ Plan to Protect Stock Exchanges From Hacking Isn’t Going to Work

Bad news for stability in the financial markets.

<a href="http://www.shutterstock.com/cat.mhtml?lang=en&search_source=search_form&version=llv1&anyorall=all&safesearch=1&searchterm=hacker&search_group=#id=81211444&src=cJ15uJxDIJ_naKb2C0KyZA-1-96">F. ENOT</a>/Shutterstock

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.


Last week, a US federal court indicted a Russian hacker named Aleksandr Kalinin for allegedly hacking into the NASDAQ stock exchange. Kalinin had access to two NASDAQ servers for a couple of years between 2007 and 2010, and during that time was able to enter commands to change and delete data. The case has heightened fears that the next time a trading system is hacked—which is becoming pretty common—rogue programmers could cause a financial collapse. The good news is that the US government has recently drafted a plan to combat stock exchange hackers. The bad news, experts say, is that the government’s plan is not going to help much.

The government’s anti-hacking plan comes in the form of a regulation recently proposed by the Securities and Exchange Commission (SEC), a Wall Street regulator. The rule would require exchanges, including NASDAQ, the New York Stock Exchange, and the Chicago Mercantile Exchange, to ensure that their trading technologies adhere to a set of standards that the SEC has for two decades urged exchanges to adopt voluntarily. It would force exchanges to conduct stress tests of their core technology, submit to regular system reviews to identify vulnerabilities to hackers, and draft recovery plans in case of security breaches. But financial reform advocates, software security experts, and cybersecurity gurus say the rule is far too weak to provide any meaningful protection against cyber criminals.

The way that the SEC defines whether an exchange is adhering to the regulation is too vague, says Dennis Kelleher, the president of Better Markets, a financial reform group. Instead of laying out specific requirements for system reviews, for example, the SEC “defer[s] to unspecified practices and standards set by other regulators or ‘widely recognized’ organizations,” Kelleher wrote in a letter to the agency. Without clearer language, Kelleher worries, exchanges could comply with the letter of the regulation without making any meaningful security upgrades. (The SEC declined to comment for this story.)

The vagueness of the proposed SEC rule also means that it won’t require real security testing of exchange software, warns Bill Curtis, director of the Consortium for IT Software Quality, an industry group that develops software quality standards. Instead, Curtis says, exchanges will be able to get away with a mere functional test of the technology, to make sure “it computes the thing I’ve asked it to compute,” Curtis says. Unfortunately, Curtis notes, testing whether a piece of software works is not the same as testing whether it is vulnerable to hackers.

The financial industry, which hates the proposed rule, may be able to weaken it even further. In letters submitted to the SEC, the New York Stock Exchange and the Chicago Mercantile Exchange warned that the rule will “cost significantly more than any derived benefit.” Both the Financial Industry Regulatory Authority, a private corporation that oversees the NYSE, and the Securities Industry and Financial Markets Association, the leading securities industry trade group, say that the SEC’s anti-hacking measures are overly broad and should be scaled back.

Ultimately, it may not matter all that much whether the industry gets its way and weakens the regulations, because “policy is never sufficient to secure your environment,” says Steve Surdu, a vice president at the cyber-security firm Mandiant. Although cybersecurity experts agree that new security regulations will do some good, when you’re dealing with trading systems that are massive and complex, it’s impossible to imagine all the security precautions that are necessary, let alone enforce them, Surdu says: “The NASDAQs of the world—they have large infrastructure, there are many systems…there are changes in the environment all the time…and the bad guys only need to find one lapse to take advantage of it.”

It’s hard to outfox a hacker, agrees Alyssa Hutnick, a partner at the law firm Kelley Drye, which represents clients in computer protection cases. “Yes, it’s reasonable to have a written information security program and risk assessment program,” she says, but that’s more to “make people feel good,” she jokes. “It’s a whack-a-mole issue…Whatever [hackers] were doing last month is not what they’re doing today, and not what they’re going to be doing next month.”

The best way to outsmart a potential stock exchange hacker, Surdu says, would be to “isolate yourself physically” from the internet—”which is not possible” for exchanges.

All this to say we could easily be careening towards a hacker-induced financial disaster. “There’s an awful lot of confidential information in those systems,” Curtis says. “If they can get in there and can crack into these systems and get into trading and get into your accounts, they can start doing all kinds of things…to disrupt markets…and create mayhem.”

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with the Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate