French Bank Says Trader Hacked Computers

January 28th, 2008

Well, well, well… I’m glad I included the BS option in my initial post on this incident.

Please see, Unloading Toxic Waste Mortgage Backed Securities: “We Americans Were Very Clever,” and pay close attention to the part about the timing:

We’ll see how clever they are when the Good Fellas show up to collect.

At some point, this thing is going to start looking less like a financial crisis and more like a mob war.

How do I know?

Because I got a job that resulted from a decapitation strike against the computer systems of a wholly owned subsidiary of a Wall Street firm that was heavily involved with generating subprime loans and selling the resulting mortgage backed securities.

I haven’t talked about this before in public, but a core Cryptogon contributor wondered if the organizations that wound up with the toxic waste paper would eventually attempt to settle the score in a less than pleasant manner, if you know what I mean…

I wrote a candid response to him because I’ve wanted to tell this story many times, but was afraid to do it here on Cryptogon.

At the time, the Mother Ship was content to allow the red headed step child to run its own systems. As long as the paper got to where it needed to be at the end of the month, each month, no worries, fuggetaboutit.

Someone compromised this operation at the root level, they understood the timing and then they launched an attack that literally blew the support columns out from underneath the entire thing THE DAY BEFORE THE PAPER DUMP at the end of the month.

Now, it might be easy to miss, but I’m going to pull out a couple of paragraphs from the Business Week story below:

Since those bets greatly exceeded the amount of capital he was allowed to put at risk, Kerviel entered fictitious and offsetting trades in Societe Generale’s computer system that appeared to minimize the odds of big losses, the bank said. The trades were purposely chosen to avoid detection because they did not require cash contributions and were not subject to margin calls, which would require putting up more money if the fictitious bet soured, it said.

Societe Generale said Kerviel misappropriated other people’s computer access codes, falsified documents and employed other methods to cover his tracks — helped by his previous years of experience when he worked in other offices at the bank that monitor traders.

Woh. Stop right there.

Kerviel, according to legend, entered fictitious hedge positions that tricked the bank’s risk exposure system into ignoring the real positions!?

If the people behind this had bombed the bank’s headquarters into a pile of rubble and killed all the executives, they would have done far less damage than what was accomplished with this hack. Or, this is a smoke screen being used to try to hide even more unthinkable financial horrors.

The piece also says that Kerviel, “misappropriated other people’s computer access codes.”

Two factor authentication has been standard in the finance industry for years. Simply: Two different authentication methods are required for access to critical systems. Access is only granted when a user supplies his or her credentials (username and password) ALONG WITH some other security token, usually a cryptographic security token that is displayed on a small device. (Biometrics are an option for the other factor.) The cryptographic signature changes every several seconds. It is synced with the server that is providing authentication. The token is usable only once, and within a very narrow time window.

In other words, when they’re saying that Kerviel, “misappropriated other people’s computer access codes,” did he go around and ask to borrow their one-time-pass cryptographic token generators, as well as their usernames and passwords?

I really don’t know what this situation at Societe Generale represents, but I can tell that it’s not the work of one man.

No way.

Via: Business Week:

Societe Generale said Sunday that a trader who evaded all its controls to bet $73.5 billion — more than the French bank’s market worth — on European markets hacked computers and “combined several fraudulent methods” to cover his tracks, causing billions in losses.

The bank says the trader, Jerome Kerviel, did not appear to have profited personally from the transactions and seemingly worked alone — a version reiterated Sunday by Jean-Pierre Mustier, chief executive of the bank’s corporate and investment banking arm.

But, in a conference call with reporters, Mustier added: “I cannot guarantee to you 100 percent that there was no complicity.”

Kerviel’s lawyer said the accusations of wrongdoing against his client were being used to hide bad investments by the bank related to subprime mortgages in the United States.

“He didn’t steal anything, take anything, he didn’t take any profit for himself,” the lawyer, Christian Charriere-Bournazel, told The Associated Press by telephone. “The suspicion on Kerviel allows the considerable losses that the bank made on subprimes to be hidden.”

Officials said Kerviel was cooperating with police, who held him for a second day of questioning Sunday, seeking answers to what, if confirmed, would be the biggest-ever trading fraud by a single person.

The questioning was “going very well and the investigation led by the specialists of the financial police is extremely fruitful,” said Jean-Michel Aldebert, head of the financial section of the Paris prosecutor’s office.

Kerviel was giving “very interesting” explanations, Aldebert added. “From what he told me, he was fine psychologically.” He refused to say whether Kerviel might face preliminary charges.

Kerviel, 31, has not been seen in public since the bank’s bombshell revelation Thursday that his unauthorized trades resulted in 4.9 billion euros ($7.1 billion) in losses.

Even before his massive alleged fraud came to light, Kerviel had apparently triggered occasional alarms at Societe Generale — France’s second-largest bank — with his trading, but not to a degree that led managers to investigate further.

“Our controls basically identified from time to time problems with this trader’s portfolio,” Mustier said.

But Kerviel explained away the red flags as trading mistakes, Mustier added.

“The trade was canceled, there was no specific follow-up to do,” he said. “From our understanding today, the number of mistakes was not higher than (for) any other trader, so from our understanding that was not a reason to ring a bell.”

Kerviel’s lawyer said the trader made money for the bank through 2007 and has since been “thrown to the wolves of public opinion.”

“He made profits for the bank until Dec. 31. From Jan. 1, he took risky positions like all traders,” said Charriere-Bournazel, who is also president of the Paris bar association.

In a five-page statement Sunday, the bank said Kerviel used its money to build massive positions in futures contracts tied to the performance of baskets of stocks traded on exchanges in London, Paris, Frankfurt and other European markets.

Since those bets greatly exceeded the amount of capital he was allowed to put at risk, Kerviel entered fictitious and offsetting trades in Societe Generale’s computer system that appeared to minimize the odds of big losses, the bank said. The trades were purposely chosen to avoid detection because they did not require cash contributions and were not subject to margin calls, which would require putting up more money if the fictitious bet soured, it said.

The bank said he plowed 30 billion euros ($44.1 billion) into the Eurostoxx index, another 18 billion euros ($26.5 billion) on the DAX in Germany and 2 billion euros ($2.9 billion) on the FTSE in London. The combined value of those positions, 50 billion euros ($73.5 billion), is far more than the bank’s market capitalization of 35.9 billion euros ($52.6 billion), and close to the annual GDP of countries such as Slovakia, Qatar or Libya.

Societe Generale took three days last week to sell or offset with hedges his contracts, which amounted to bets on whether market indexes would rise or fall. But the bank sought Sunday to counter suggestions that its sell-off had caused already falling markets to plummet further than they otherwise might have done. The bank said it unwound Kerviel’s positions in “a controlled fashion.”

“Our impact on the market was quite minimal,” Mustier said.

Societe Generale said Kerviel misappropriated other people’s computer access codes, falsified documents and employed other methods to cover his tracks — helped by his previous years of experience when he worked in other offices at the bank that monitor traders. Acquaintances described Kerviel as reserved and considerate, a young man who once taught children judo and held the door for elderly neighbors.

Kerviel’s downfall started in the days before Friday, Jan. 18, when Societe Generale tightened lending restrictions on one of its customers, an unnamed large bank. He had apparently used that bank’s name for one or more of his fictitious trades, and it led to what Societe Generale described as having “additional controls” put in place.

Kerviel’s superiors in Societe Generale’s equity trading division reviewed an e-mail that day from the large bank supposedly confirming trades he had booked. But they were suspicious about where the e-mail came from and launched an emergency investigation.

A day later, Kerviel was called to Societe Generale to explain. In the meantime, bank investigators confirmed that the large bank did not know about the trades.

After first not providing a clear explanation, Kerviel eventually confirmed that he had entered fictitious trades, the bank said. It then took a bank team throughout the night and into Sunday, Jan. 20, to identify all the exposure. Societe Generale’s chief executive, Daniel Bouton, notified the governor of the Bank of France that day, and a decision was made to unwind the trades as quickly and as quietly as possible.

A complicating factor was that the bank was finishing work that Sunday on details of a separate announcement about the size of the multi-billion-dollar charge it would take for bad bets on mortgage-related investments in the U.S. News of that misstep was delayed until Thursday, when along with the fraud losses, the bank said it would take a 2.05 billion euro ($2.99 billion) write-down.

Societe Generale traders began unwinding Kerviel’s losing bets at the beginning of European trading on Monday, just as Asian markets were in a free-fall and European shares were poised to plummet after a big drop in U.S. markets on the previous Friday. It took until Wednesday to finally close the books on Kerviel’s adventures, the bank said.

Kerviel’s lawyer cast suspicion on the way Societe Generale unwound the position, saying it did so in “totally unusual conditions.”

“This decision was driven by other motives,” he claimed, without elaborating.

Some experts have suggested Societe Generale may have exacerbated the fall and indirectly led to the U.S. Federal Reserve’s subsequent decision to cut rates.

But in its explanatory note released on Sunday, the bank defended itself by saying the trades represented no more than 8.1 percent of the volume in futures trading each day on the Eurostoxx, DAX and FTSE.

Mustier said Kerviel’s motivations were still unclear. “We don’t know, we don’t understand” what drove him to do it, he said.

“This event is a massive shock for us,” he said.

The bank said Kerviel built up two portfolios of investments — but that one of them consisted of “fictional operations,” leaving the bank hugely exposed.

“In order to ensure that these fictitious operations were not immediately identified, the trader used his years of experience in processing and controlling market operations to successively circumvent all the controls which allow the bank to check the characteristics of the operations carried out by its traders,” the bank’s statement said.

“He had a very good understanding of all of Societe Generale’s processing and control procedures.”

It was the bank’s most detailed explanation yet of the debacle that has further rattled the banking industry, already reeling from the subprime mortgage crisis in the U.S. Some observers have said the crisis could also leave the bank vulnerable to a takeover.

An aide to French President Nicolas Sarkozy suggested the state could step in to prevent any possible hostile bids.

“I think the state will not stand idly by if any predator attempts to take advantage of the situation,” Henri Guaino told RTL radio on Sunday.

The situation has prompted calls for tighter regulation — 13 years after trader Nick Leeson, whose illegal speculation bankrupted British bank Barings, first highlighted the potential risks from rogue traders operating without proper oversight.

2 Responses to “French Bank Says Trader Hacked Computers”

  1. Eileen says:

    I can’t believe that this “guy,” did what they the news “says he did.” In fact, this story stinks like the paper that wrapped last Friday’s fish.

    Yah Kevin. To access my work email remote I have a digital, random generator access key. For email! Comon. There is no way this guy could access this stuff at a bank, doing trades?
    Ha Ha ha.

    What did this guy really do? Steal from petty cash? Get caught with a few extra francs from his cash drawer? Plead to get off for claiming this greater sin?

    A sucker is born every minute.
    Don’t you be one of them and believe this fraud story.
    Subprime, mud prime.
    Yada yada yada.
    These banks are starting to dance the news step with smoke and mirrors and dance just like Fred Astaire and Ginger Rogers used to.

    Wonder why the news doesn’t say whether customers lost anything – is there any real human pain here or is this something for the bank to “explain the PAIN on their balance sheet?

  2. st0ckman says:

    this is a scam. i covered this on my blog st0ckman.blogspot.com last week, stating it may be due to the subprime mess. i also have 7 clips from cnbc, bloomberg and cnn on my youtube page
    http://youtube.com/st0ckman on jerome kerviel. they main thing is the bank is not pressing full charges against kerviel so they do not have to disclose certain things. there is also another bloger i linked to last week that feels the same way.
    thanks kevin, i am going to quote you. if you dont want the quote up ill take it down. just email me
    -st0ckman (spell with a zero)

Leave a Reply

You must be logged in to post a comment.