Financial Industry Favors Security Through Obscurity; Demands Cambridge Censor Paper Detailing Weaknesses

from the that'll-work dept

The chip and PIN system that is used for financial transactions throughout large parts of Europe and Canada (still surprised that it hasn't really come to the US...) has numerous vulnerabilities that have been detailed over the years. In the past year alone, there have been a number of problems and weaknesses highlighted with the system. Apparently, the financial industry isn't happy about this, but rather than fixing the problems it's reacting in the usual way: going after the messenger. Slashdot points us to the news that the UK Cards Association -- a trade group representing banks and credit card companies -- has asked Cambridge researchers to remove a thesis which highlights some of the vulnerabilities.

You can see the demand letter embedded below, but it's fairly amusing. The letter claims that the publication (which you can read about on the author's (Omar Choudary) website, where he describes a device for intercepting, monitoring and modifying such data) "oversteps the boundaries of what constitutes responsible disclosure." In other words, they're not happy about it, so Cambridge should force the student to shut up. Of course, what's amusing is that after chiding Cambridge University for such irresponsible publishing, the Association then tries to downplay the significance of the whole thing anyway:

Fortunately, the type of attack described in the research is difficult to undertake and is unlikely to carry a sufficient risk-reward ratio to interest genuine fraudsters. And, in the unlikely event that such an attack were to take place in the UK marketplace, the banking industry's fraud prevention systems would be able to detect when such an attack had happened.

So why take it down?

Nevertheless, publication of such details could encourage nuisance attacks on the payment card systems, undermine public confidence in them and/or give organised crime access to material they might be able to develop further.

This, of course, is the very definition of an organization that thinks security through obscurity works. The thing is, if these students figured out these problems, it's pretty damn likely that organized crime already had figured out the same thing and probably have already developed the idea much further. Pretending otherwise is simply naive.

The UK Cards Association then goes on to lecture Cambridge University on its standards of what should be considered publishable, and worries about "future research." The response from Ross Anderson at Cambridge (linked above) is pretty straightforward, basically saying, yes, you absolutely should be worried about it:

The bankers also fret that "future research, which may potentially be more damaging, may also be published in this level of detail". Indeed. Omar is one of my coauthors on a new Chip-and-PIN paper that's been accepted for Financial Cryptography 2011. So here is our Christmas present to the bankers: it means you all have to come to this conference to hear what we have to say!

A note to the financial industry: perhaps instead of worrying about student papers, you should worry about a system that is vulnerable to so many problems.

Filed Under: banks, cambridge, chip and pin, credit cards, obscurity, security, uk

Is It Identity Theft Or A Bank Robbery, Part II: Couple Sues Bank Over Money Taken

from the i've-still-got-my-identity dept

Last month, we posted an amusing discussion (and comedy act) concerning whether or not "identify theft" was really a crime, or if it was really a bank robbery where the bank was passing off the liability for its poor authentication system onto the bank customer. Apparently, just such an argument is already playing out in the courts. Steven Hoy alerts us to a story of a couple who are suing their bank, after someone masquerading as them accessed their account and transferred $26,000 to Austria. The details of the case are a bit complex, but basically, the couple claims that the bank did not live up to basic standards in authentication, and cite the Federal Financial Institutions Examination Council's claim that notes that "single-factor authentication is inadequate and calls on banks to implement two-factor systems." Thus, the argument goes, the fault was the bank's security, and thus, the bank should be liable. The judge found that to be convincing:

"In light of Citizens' apparent delay in complying with FFIEC security standards, a reasonable finder of fact could conclude that the bank breached its duty to protect Plaintiffs' account against fraudulent access.... If this duty not to disclose customer information is to have any weight in the age of online banking, then banks must certainly employ sufficient security measures to protect their customers' online accounts."

Chalk one up for those who believe "identity theft" is actually a "bank robbery."

Filed Under: banks, identity theft, scams, security

The Good And Bad Of Banks Too Big To Fail Getting Bigger...

from the not-all-bad,-but... dept

Ever since the whole financial crisis began, and the concept of "too big to fail" became a common phrase, I've been wondering why the US gov't didn't set up a simple provision in any bailout procedure: if you are too big to fail, and because of that need a gov't bailout, then a part of that bailout means you need to become small enough to fail. I think it's a perfectly reasonable suggestion that has been pretty much totally ignored.

So, when news came out that the biggest banks, the ones deemed "too big to fail," are now getting even bigger, you might think that I'd view that as a bad sign. And... partly, I do. But not for the reasons you might expect. The issue of "too big to fail" isn't the bottom line size of the bank, it was about how interconnected it was in the rest of the economy, and how any ripple effects of a failure would damage (significantly) other parts of the economy. But, since the government has done pretty much next to nothing to actually deal with that sort of systematic risk (and, no, putting in place a "systematic risk" manager, as we keep hearing, isn't going to fix the problem), it should come as no surprise that these banks still have such risks.

But, the fact that, by themselves, these banks are growing isn't a bad sign. Given what the government has done, it's actually a good sign. You should be a lot more upset if, after the government gave these banks so much money, they went out and lost it all. Instead, many of them have at least put it to good use (and some have returned money to the government at decent interest rates -- though, the amount returned still is a blip compared to the amount at risk).

The real issue isn't the size of the banks, but how interconnected they are. But little to nothing has been done to take on that problem -- which is a bad thing. However, given that, it's at least a decent sign that these banks we've given so much money to are actually doing better these days.

Filed Under: banks, radical transparency, risk, systematic risk, too big to fail, transparency

The Contrarian Banker Who Avoided Bad Loans... And Is Now Buying Up The Scraps

from the no-gov't-money-needed dept

While we've wondered why those who made such bad bets on Wall Street are getting bailed out and even relied upon to save the economy, Forbes has found one of the guys who knew better: Andy Beal. A banker in Texas who basically stopped taking on any new loans for years as he thought things were going out of control. In fact, he barely worked at all -- stopping by just a few hours a day, playing board games with his staff, and even laying off about half of his employees. He did this while waiting for the market to collapse, knowing that things were way out of control. In return, he got investigated by regulators, who couldn't understand why he wasn't joining in the fun.

Of course, now that things have collapsed, he's buying up distressed assets for pennies on the dollar, and wants to buy more, planning to become a huge bank. Oh, and all that government money that's supposed to help those private companies who are buying up these assets? He doesn't qualify for most of it (no more than a token amount that's not even worth taking). Instead, it's really designed for the folks who screwed things up in the first place. This guy -- who actually saw what was going on, and prepared for it, now has to compete against those who screwed up and are being handed billions by the government.

Filed Under: andy beal, banks, contrarian, economy, loans

Instead Of Bailing Out Broken Banks, Why Not Build New Banks?

from the thinking-out-of-the-box dept

Plenty of people are pretty angry about the financial bailout, where it often looks like taxpayers are effectively handing over money to banks who screwed up big time by betting excessively on high risk investments, and borrowing a ton of money in the process. However, the argument from the other side (which does make sense) is that the "alternative" could be the collapse of the global financial system, and that would have such far reaching impacts that it's not at all desirable. But, that assumes the only options are to either bailout the banks or to let them fail entirely. Some are trying to come up with other options. Salman Khan and David Leinweber have come out with a suggestion that instead of bailing out banks, the government should take the $700 billion and use it to fund an entirely new financial sector. Then, as the screwed up banks fail, these new banks can take over their discarded assets.

This certainly has some appeal. The idea is that you wouldn't be rewarding shareholders in the original banks and also wouldn't be allowing the entire capital engine to seize -- and, on the flip side, you also might be rewarding the shareholders of the new banks (the American taxpayer). However, there's also tremendous risk in doing this. In effect, it's something like building a new airplane from within a troubled airplane that's flying at 40,000 feet, getting it to fly from the air, and then moving people from the troubled airplane to the new one. There's an awful lot that can go wrong. Also, in doing this in such a rapid fashion, when it's still not entirely clear what all the root causes of this crisis are, you run the risk of simply transferring the core problems to these new banks (basically taking the problems from the first airplane to the second, if we continue the analogy). Then you end up spending $700 billion to basically create a new set of troubled banks that are even more confusing, because they were put together in a rush. So, while it's an interesting idea, it seems like it would present some significant problems as well.

Filed Under: bailout, banks, financial crisis

Liquidity vs. Solvency In The Financial Crisis

from the jumpstarting-the-economy dept

There's been a fair amount of interest in my last few posts on the financial crisis and The Insight Community has been providing some great analysis on how the financial crisis is impacting small businesses. You can see some of the initial input over on American Express's OpenForum blog, as they're sponsoring that discussion. Some good posts to check out are Dennis Howlett's quick tips for small businesses and Zack Miller's concept of "black swan" contingency planning for small businesses. We'll definitely have more on the small business front coming up, but I wanted to go back to what's going on with the banks.

After my initial post, I got an email suggesting that I put too much emphasis on the liquidity problem, and not enough on the insolvency problem. There's been something of an ongoing discussion on this point on various websites, and even the Wall Street Journal got into the act a few days ago, talking to Milton Friedman's co-author on A Monetary History of the United States, Anna Schwartz, who makes the point that the problem absolutely is an insolvency issue, while it appears that much of the federal bailout is focused on dealing with a liquidity problem.

So, what's the difference? In simple terms (and, yes, I'm sure the super finance types may quibble over the specifics, but this should get the broad strokes correct), liquidity problems occur when an entity owes money but doesn't have readily available cash to pay off those debts. They may have other assets, and generally speaking, if they're facing a liquidity problem, they're likely to try to sell off those assets, potentially below cost, just to get the money they need to pay off their debts. Say, for example, you owe $100 for your car loan each month, but don't have the cash to make the payment. You might try to sell something else you own to get that cash, and if you're desperate enough, you may even sell something for less than it's worth, just to get the cash and avoid defaulting.

But much of the problem in the financial world over the past few weeks hasn't been a lack of liquidity but an unwillingness to lend. That is, the banks have a ton of cash on hand, but they're afraid to give it out to anyone, because they don't know if whoever they lend it to will still exist when it comes time to repay. So, instead of lending it out, they're dumping it into the safest of safe investment vehicles: US gov't treasury bonds, even though they pay almost no interest. As the good folks on Planet Money note, treasuries are about the equivalent of stuffing the money into your mattress. You won't lose the money, but you won't make any interest either.

Basically, many of the banks have liquidity (cash), but are so afraid that the others they lend to are insolvent (unable to pay back loans) that they won't loan. That's why you may have heard more and more people talking about the (until recently) obscure "TED spread," which basically represents the difference between the interest rate at which banks are lending to each other (the LIBOR -- or London InterBank Offered Rate) and the interest rate on US treasuries. It's a quick measure to determine how secure banks feel about lending to each other vs. putting money in the proverbial mattress. In normal times, this is pretty small, because lending short term money out to other banks is considered pretty damn safe -- almost as safe as lending to the US government. So, it's usually well below 1%. Over the past few weeks, it's been sitting above 4%, on many days -- which basically means that banks are simply sitting on their cash because they don't trust other banks at all. This week, it finally started dropping, representing at least some easing of concern (though it's still pretty high).

So, as you can see, there's plenty of money in many of these banks, suggesting that they're not so worried about liquidity, but the solvency of everyone else they deal with. Of course, the two things overlap a bit. A bank that doesn't have liquidity may then be considered insolvent as well. On the good side, it looks like the federal government is finally recognizing the difference between liquidity and solvency and is trying to deal with the solvency issue by effectively agreeing to buy up commercial paper from money market funds. Basically, the issue here is that the commercial paper market has been standing still. As we described in our earlier post, this is the short-term lending that goes on between companies all the time, and is important for their liquidity. But with the money market managers afraid of insolvency, they're unwilling to lend money out, if there's not enough evidence they'll get it back. So, now, the government is basically saying, "go ahead and lend it out, and we'll make sure that it gets paid back." That could present a huge risk in terms of pushing the market to do bad loans and stick them to the US government, but as a short-term measure it can certainly help in kick-starting the market. Unfortunately, there are already some complaints that the rules are way too confusing.

That said the real problems touch on both liquidity and solvency, so the real solution needs to deal with both. If we don't deal with the worries over solvency, then we'll have a much bigger liquidity problem across the economy. Because the banks are afraid to lend money out, lots of companies are unable to then get the money they need for daily operations -- and then they become insolvent, creating a disastrous domino effect. Those with money are afraid to lend it, because they're afraid they won't get it back -- and their unwillingness to lend is making it so that others really can't meet their obligations. So, while there's some argument about solvency vs. liquidity, a solvency problem at one part of the chain can create a liquidity problem elsewhere, which in turn leads to solvency problems. This is why it is rather important to get those with money to get it moving again, or it very much is like an engine running out of oil. Just dumping money into the market can help somewhat, but until recently, it was mostly going to banks who already had cash, but weren't lending it.

So, what's it all mean? Well, as of today (and these things are changing pretty quickly), the past few weeks showed that no one was lending to anyone as they all seemed to fear that the folks on the other side wouldn't be around or able to give the money back within the next three months or so. That created a pretty significant risk of limited cash flow problems. The initial moves by the gov't with the bailout didn't seem to do much to deal with that problem, but its more recent moves suggest it now recognizes the real issue and will do what's necessary to fix it. My fear, at this point, is that in typical government fashion, it turns the spigot too far, leading to a situation where, in order to force liquidity into the rest of the market, we end up encouraging and paying for bad loans.

Needless to say, this is still a pretty complex situation, and while it looks like we may have (so far) avoided the worst case scenario, there's reason to be afraid that in all the knob spinning the Fed is doing, we're going to end up overshooting in both directions at points, and that can be just as dangerous in simply delaying inevitable pain.

Filed Under: banks, financial crisis, liquidity, solvency, ted spread

Disgruntled Tech In Liechtenstein Steals Banking Info On Tax Cheats; Turns It In For Rewards

from the good-or-bad? dept

Forget the disgruntled tech holding the city of San Francisco hostage. An even more interesting story of a disgruntled tech is coming out of the tiny European country of Lichtenstein. Apparently (who knew?) Lichtenstein is a favorite destination for money of rich folks looking to avoid taxes. It's banking system is apparently quite secretive... except, of course, in the hands of a disgruntled computer tech. It appears that just such a tech, named Heinrich Kieber walked off with tons of data from Liechtenstein LGT Group, a bank owned by Lichtenstein's ruling family. He then sold that data to a variety of countries to help those countries find and arrest tax cheats. This turned out to be quite lucrative for Kieber. For example, the US offers such "whistle blowers" 30% of whatever tax money they recover. Germany apparently paid him somewhere between $6 million and $7.3 million for the info. The guy's lawyer insists he's a whistleblower -- while those exposed have a different word (or words) they think of when discussing Kieber.

Filed Under: banks, disgruntled tech, heinrich kieber, lichtenstein, tax cheats, whisteblower
Companies: lgt group

Why Should Banks Be Responsible For Stopping Internet Gambling?

from the always-looking-for-the-easy-way-out dept

As the federal government continues its quixotic quest to stamp out online gambling for no clear reason (other than, you know, to protect our ports), it's now putting the responsibility on banks to block online gambling. Why banks? That's not entirely clear, but banks may now be responsible for making sure that individuals can't transfer money to various online gambling operations. All this for an activity that doesn't appear to create any additional problem gamblers. There are those who say it's all because the federal government wants to tax online casinos, but that doesn't ring true either -- since they're shutting them down rather than taxing them. Many online casinos would love to be taxed if they could legally do business in the US. Instead, it seems to just be that some politicians claim not to like online gambling for moral reasons -- though they were careful to carve out exceptions for wholesome online gambling like horse races and state lotteries.

Filed Under: banks, online gambling

More Banks Set To Establish Their Own Stock Exchanges

from the privately-public dept

Last week, private equity firm Apollo Management announced that it would sell shares of itself on a private stock exchange run by Goldman Sachs. Because the exchange is closed to most investors, companies listing on it don't have to comply with various government regulations, which they would if they were to list on, say, the New York Stock Exchange. Considering all of the headaches associated with being a public company these days, this option may look increasingly appealing for companies looking for an alternative way to raise money and give its owners liquidity. It's not surprising, then, that many of the big name investment banks, including Citigroup, JP Morgan, Lehman Brothers, and Morgan Stanley are all rushing to build out their own private, electronic stock exchanges. The question, however, is whether or not these various exchanges will be compatible or whether they'll be islands, with little inter-exchange trading. If they're the former, then a robust alternative market could flourish. If it's the latter, then the appeal to both traders and companies is likely to be limited.

Filed Under: banks, wall street
Companies: citigroup, goldman sachs

If You Own An ATM, You Probably Want To Change The Default Password

from the 123456-really-isn't-very-secure dept

Nearly two years ago, we posted a story about how easy it was to find the user manuals for certain automatic teller machines online, and then use the default passwords listed in them to reprogram the machines so they'd give out $20 bills when they thought they were giving out $5s or $1s. The fix for this was easy -- change the default passcode -- but apparently it wasn't hard to find machines whose owners' hadn't changed them. Somehow, it really isn't too surprising to find out that, despite the publicity, some ATM owners still haven't bothered to change them, and are getting hit by the same scam. The owner of the machine in question this time, at a market in Pennsylvania, says that he was never told he needed to change the master passcode from "123456", and says it's not his job to know the technical ins and outs of the ATM he owns (despite, of course, owning it and the money inside); the ATM's manufacturer disagrees. As is the case with most things, there's probably enough blame to go around here. So, to the ATM company: it might be a good idea to reinforce the need for owners to change their machines' passwords. And ATM owners: change the default passwords.

Filed Under: atm, banks, security