The Feds’ Plan to Protect Stock Exchanges From Hacking Isn’t Going to Work

Bad news for stability in the financial markets.

<a href="http://www.shutterstock.com/cat.mhtml?lang=en&search_source=search_form&version=llv1&anyorall=all&safesearch=1&searchterm=hacker&search_group=#id=81211444&src=cJ15uJxDIJ_naKb2C0KyZA-1-96">F. ENOT</a>/Shutterstock

For indispensable reporting on the coronavirus crisis, the election, and more, subscribe to the Mother Jones Daily newsletter.


Last week, a US federal court indicted a Russian hacker named Aleksandr Kalinin for allegedly hacking into the NASDAQ stock exchange. Kalinin had access to two NASDAQ servers for a couple of years between 2007 and 2010, and during that time was able to enter commands to change and delete data. The case has heightened fears that the next time a trading system is hacked—which is becoming pretty common—rogue programmers could cause a financial collapse. The good news is that the US government has recently drafted a plan to combat stock exchange hackers. The bad news, experts say, is that the government’s plan is not going to help much.

The government’s anti-hacking plan comes in the form of a regulation recently proposed by the Securities and Exchange Commission (SEC), a Wall Street regulator. The rule would require exchanges, including NASDAQ, the New York Stock Exchange, and the Chicago Mercantile Exchange, to ensure that their trading technologies adhere to a set of standards that the SEC has for two decades urged exchanges to adopt voluntarily. It would force exchanges to conduct stress tests of their core technology, submit to regular system reviews to identify vulnerabilities to hackers, and draft recovery plans in case of security breaches. But financial reform advocates, software security experts, and cybersecurity gurus say the rule is far too weak to provide any meaningful protection against cyber criminals.

The way that the SEC defines whether an exchange is adhering to the regulation is too vague, says Dennis Kelleher, the president of Better Markets, a financial reform group. Instead of laying out specific requirements for system reviews, for example, the SEC “defer[s] to unspecified practices and standards set by other regulators or ‘widely recognized’ organizations,” Kelleher wrote in a letter to the agency. Without clearer language, Kelleher worries, exchanges could comply with the letter of the regulation without making any meaningful security upgrades. (The SEC declined to comment for this story.)

The vagueness of the proposed SEC rule also means that it won’t require real security testing of exchange software, warns Bill Curtis, director of the Consortium for IT Software Quality, an industry group that develops software quality standards. Instead, Curtis says, exchanges will be able to get away with a mere functional test of the technology, to make sure “it computes the thing I’ve asked it to compute,” Curtis says. Unfortunately, Curtis notes, testing whether a piece of software works is not the same as testing whether it is vulnerable to hackers.

The financial industry, which hates the proposed rule, may be able to weaken it even further. In letters submitted to the SEC, the New York Stock Exchange and the Chicago Mercantile Exchange warned that the rule will “cost significantly more than any derived benefit.” Both the Financial Industry Regulatory Authority, a private corporation that oversees the NYSE, and the Securities Industry and Financial Markets Association, the leading securities industry trade group, say that the SEC’s anti-hacking measures are overly broad and should be scaled back.

Ultimately, it may not matter all that much whether the industry gets its way and weakens the regulations, because “policy is never sufficient to secure your environment,” says Steve Surdu, a vice president at the cyber-security firm Mandiant. Although cybersecurity experts agree that new security regulations will do some good, when you’re dealing with trading systems that are massive and complex, it’s impossible to imagine all the security precautions that are necessary, let alone enforce them, Surdu says: “The NASDAQs of the world—they have large infrastructure, there are many systems…there are changes in the environment all the time…and the bad guys only need to find one lapse to take advantage of it.”

It’s hard to outfox a hacker, agrees Alyssa Hutnick, a partner at the law firm Kelley Drye, which represents clients in computer protection cases. “Yes, it’s reasonable to have a written information security program and risk assessment program,” she says, but that’s more to “make people feel good,” she jokes. “It’s a whack-a-mole issue…Whatever [hackers] were doing last month is not what they’re doing today, and not what they’re going to be doing next month.”

The best way to outsmart a potential stock exchange hacker, Surdu says, would be to “isolate yourself physically” from the internet—”which is not possible” for exchanges.

All this to say we could easily be careening towards a hacker-induced financial disaster. “There’s an awful lot of confidential information in those systems,” Curtis says. “If they can get in there and can crack into these systems and get into trading and get into your accounts, they can start doing all kinds of things…to disrupt markets…and create mayhem.”

SIX TRUTHS

Reclaiming power from those who abuse it often starts with telling the truth. And in "This Is How Authoritarians Get Defeated," MoJo's Monika Bauerlein unpacks six truths to remember during the homestretch of an election where democracy, truth, and decency are on the line.

Truth #1: The chaos is the point.

Truth #2: Team Reality is bigger than it seems.

Truth #3: Facebook owns this.

Truth #4: When we go to work, we're in the fight.

Truth #5: It's about minority rule.

Truth #6: The only thing that can save us is…us.

Please take a moment to see how all these truths add up, because what happens in the weeks and months ahead will reverberate for at least a generation and we better be prepared.

And if you think journalism like Mother Jones'—that calls it like it is, that will never acquiesce to power, that looks where others don't—can help guide us through this historic, high-stakes moment, and you're able to right now, please help us reach our $350,000 goal by October 31 with a donation today. It's all hands on deck for democracy.

payment methods

SIX TRUTHS

Reclaiming power from those who abuse it often starts with telling the truth. And in "This Is How Authoritarians Get Defeated," MoJo's Monika Bauerlein unpacks six truths to remember during the homestretch of an election where democracy, truth, and decency are on the line.

Truth #1: The chaos is the point.

Truth #2: Team Reality is bigger than it seems.

Truth #3: Facebook owns this.

Truth #4: When we go to work, we're in the fight.

Truth #5: It's about minority rule.

Truth #6: The only thing that can save us is…us.

Please take a moment to see how all these truths add up, because what happens in the weeks and months ahead will reverberate for at least a generation and we better be prepared.

And if you think journalism like Mother Jones'—that calls it like it is, that will never acquiesce to power, that looks where others don't—can help guide us through this historic, high-stakes moment, and you're able to right now, please help us reach our $350,000 goal by October 31 with a donation today. It's all hands on deck for democracy.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate