American Board of Information Security and Computer Forensics

By John Lechliter, Editor in Chief

The international credit crisis has rocked U.S. stock markets and shaken economic confidence throughout the world. Each day of the market panic sees massive drops or huge gains in stock market indexes, much of it moved by mysterious computer transactions that sometimes spike sharply in the last minutes of trading.

Terrorists around the world have targeted economic institutions before in hopes of creating instability and damage to the governments they oppose, including the United States and its allies. Al-Qaeda bombed New York’s World Trade Center buildings in 1993 and then destroyed them by flying two hijacked airliners into them on September 11, 2001. They succeeded in not only obliterating the most visible symbols of America’s financial strength, but they also shut down the U.S. Stock Exchange for nearly a week, draining untold billions of dollars from the U.S. economy.
With markets already reeling over the credit crisis, terrorists and others intent on inflicting economic damage have many options easily available to them. Some damaging techniques would not even require advanced computer skills or financial expertise. A case in point occurred on October 3, 2008, when a CNN “iReporter” posted a false rumor that Apple Computer CEO and founder Steven Jobs had suffered a “severe heart attack.” The rumor caused Apple’s stock to plummet before it recovered after the posting was proven unfounded. Though that incident was not related to terrorism, and the suspect is a teenager, it dramatically shows the power of unscrupulous use of the Internet.

Joseph Wheeler, CPA, Cr.FA, CHS-III, is a consultant and expert on financial terrorism, and he is a longtime member of the American Board for Certification in Homeland Security. He helps organizations cope with the real threats that exist to financial institutions, both public and private.
“I think manipulation of our financial system by terrorists is a real possibility,” he said in a recent interview for IHS. “I don’t know if they would try to make the current crisis we’re going through worse ... but it is a possibility.”

Wheeler said a danger exists for computer hacking, a technique that was dramatically proven effective this past summer when Russia used cyber warfare in advance of its invasion of neighboring Georgia. Distributed Denial of Service (DDOS) attacks directed at Georgian government Web sites began in July, preceding the August invasion (Markoff, 2008).

The real threat posed by computer hacking was dramatized in March 2007, when the Department of Energy’s Idaho National Lab tested whether a power plant could be damaged by hacking alone. The test proved that hackers could indeed cause a diesel generator to malfunction and even catch fire. In January 2008, a CIA analyst told U.S. utilities that hackers had succeeded in breaking into the computer systems of electric companies in undisclosed locations outside the United States, and in at least one case, the hackers succeeded in producing a power outage (Bruno, 2008).

Wheeler said terrorists could use hacking to influence or undermine the stock market system. “They can use computers to hack into the financial systems and cause problems with transactions. ... I think one of the scariest things they can do is to destroy data. That could be a real problem.”

There is no indication that hacking has had any influence on the recent gyrations in the U.S. stock market, and Wheeler adds that the sheer scope of the credit crisis makes it unlikely that terrorism has played a significant role in destabilizing world financial markets. But disrupting markets has long been a goal of terrorist groups such as al-Qaeda, and it wouldn’t surprise Wheeler if terrorists sought to take advantage of the market turmoil.

Terrorists can target markets in many ways:

Hacking
World financial markets are now largely conducted electronically, meaning that huge amounts of data must be stored on hard-drives, and electronic data must be transferred from computer to computer over various forms of networks, including the Internet.

Terrorists have opportunities to attack data both as it is being stored and transferred. Hacking into a computer network can take many forms, from breaking into a system by overcoming password protections, to spreading worms and viruses aimed at compromising systems. Denial of service attacks can overwhelm Web sites and effectively block out legitimate transactions.

“They can use computers to hack into the financial systems and cause problems with transactions, change transactions, and make transactions go away,” Wheeler said.
It may seem far-fetched that a single hacker could influence world stock markets, but that is exactly what happened in January of this year, as reported by The National Journal.
Société Générale, one of Europe’s leading financial firms, uncovered in January that a mid-level trader had made a series of “complex and bogus futures transactions” when he hacked into the bank’s security and trading systems. The hacker, later identified as Jerome Kerviel, disabled an automatic-alert mechanism that would otherwise have brought attention to his transaction. He found passwords that got him into accounting records, which he was able to change in order to conceal his actions. He even created bogus e-mails about his fraudulent trades to make them seem real. Karviel’s managers eventually uncovered the fraud, and they spent a weekend reconciling the trades in the open market. The bank lost more than $7 billion (Harris, 2008).
Experts who analyzed the aftermath of the fraud said that it placed great pressure on the futures market. When other traders saw a huge plunge in futures for no apparent reason, they panicked and started to sell everything. World stocks took a significant decline. The U.S. markets were closed in observance of Martin Luther King Jr. Day, and Federal Reserve Chairman Ben Bernanke cut interest rates by 0.75 percent to mitigate the losses (Harris, 2008). A single hacker, armed with inside information, had knocked down the first domino that touched off a world financial panic.

Some might question whether a terrorist organization such as al-Qaeda would have the financial acumen and technical sophistication to conduct a computer attack capable of bringing down financial markets. Wheeler says it’s a matter of resources that are well within the capability of al-Qaeda to find.

There’s a misconception that al-Qaeda is isolated from the world, with its leaders hunkered down in remote areas. That clearly isn’t the case, says Wheeler. “They have access to computers and televisions, and they also have contacts,” Wheeler said. “If they want to do these attacks, and if they need an analyst, they would recruit an analyst. I think they can get the expertise that they require.”

The fact that the world’s biggest military power is targeting al-Qaeda leaders has driven them to remote and inaccessible locations, but thanks to today’s technology, they can still effectively communicate with each other, even over great distances.

Al-Qaeda could be actively planning to hack into world financial markets, but its members may prefer less subtle forms of attack.

Hitting financial infrastructure
Terrorist groups, such as al-Qaeda, obviously value spectacular attacks that leave behind high body counts and terrorize entire populations. The attacks of September 11, 2001, gratified al-Qaeda’s thirst for destruction and carnage while also stabbing deep into the heart of the financial infrastructure of the United States. Only 19 attackers, armed with box cutters and basic knowledge about how to fly a jet, were able in one coordinated stroke to erase many billions of dollars of U.S. and worldwide financial wealth.

The United States was forced to respond to the attacks by enacting costly new security measures that included the formation of the U.S. Department of Homeland Security. Private businesses, such as airlines, also had pay for changes in the way they operate to increase security and lessen the chance of future hijackings.

The War on Terrorism waged by the U.S. and its allies has included conflicts in Afghanistan to root out the Taliban and al-Qaeda, as well as the invasion of Iraq, which deposed dictator Saddam Hussein.

Al-Qaeda’s leadership has recoiled under the intense pressure exerted by the War on Terrorism, with many senior and mid-level operatives killed or captured. The organization has focused on hitting “softer” targets around the world rather than inside the United States, where there has been no significant terror attack since September 11, 2001.

Wheeler cautions that terrorist groups such as al-Qaeda have a long-term strategy and may be planning an even more spectacular strike for its next operation inside the United States. “They plan for years in advance. They hit the World Trade Center in 1993, and then they hit it again in 2001—these guys are long-term planners and thinkers. ... They are in it for the long haul,” he said.

Wheeler said any terrorist strike could be made to have a financial impact. By playing the stock market, terrorists might even attempt to profit from their advanced knowledge of when strikes will occur.

After the September 11, 2001, terrorist attacks, there was widespread speculation that financial traders with al-Qaeda connections had made stock trades to profit from the damage that they knew the attacks would cause. Of particular concern were large transactions in some airline stocks immediately before the attacks, especially in “put” transactions, which essentially bet that a certain stock will fall (CBS, 2001).

Much speculation has centered on stock profits al-Qaeda allegedly reaped from playing the pre-September 11 markets, but little solid evidence has emerged. The 9/11 Commission Report, released in 2004, discounted the possibility that terrorists manipulated markets to their own advantage.

“Some unusual trading did in fact occur, but each trade proved to have an innocuous explanation,” the report concluded. “For example, the volume of put options—investments that pay off only when a stock drops in price—surged in the parent companies of United Airlines on September 6 and American Airlines on September 10—highly suspicious trading on its face. Yet, further investigation has revealed that the trading had no connection with 9/11.  A single U.S.-based institutional investor with no conceivable ties to al-Qaeda purchased 95 percent of the UAL puts on September 6 as part of a trading strategy that also included buying 115,000 shares of American on September 10.  Similarly, much of the seemingly suspicious trading in American on September 10 was traced to a specific U.S.-based options trading newsletter, faxed to its subscribers on Sunday, September 9, which recommended these trades” (9/11 Commission, 2004).

Whether or not terrorists have in the past used stock manipulation in advance of attacks, Wheeler says that such tactics remain a viable weapon in the terrorist arsenal. He described a scenario in which terrorists could make stock purchases based on a sudden upturn in the price of oil. Then they could blow up an oil refinery and thereby create the market increase that they had bet on.

Rogue governments
Could governments with deep connections to terrorism, such as Iran and Saudi Arabia, manipulate world financial markets to the detriment of the United States and its allies?
In a word, Wheeler says, yes.

Saudi Arabia, especially, has an important influence on the world’s oil supply. “They produce a majority of the world’s oil,” Wheeler said. “If the Mideast cuts back on sales to the U.S. and instead sells to India or China, it would have a major effect.”

Earlier this year, speculation in the world oil commodity markets more than doubled the price of a barrel of crude oil, from $70 to $147. The skyrocketing cost was blamed on increased demand for oil in nations such as China and in a weakened U.S. dollar (Baum, 2008). The world oil supply is traded in U.S. dollars.

Since the global credit crisis, oil prices have plummeted even more rapidly, back below $70 a barrel and still falling as of late October. Again, the cause of the decline was unclear, attributed in large part to an expected decreased demand in Third World nations because of the financial crisis (Baum, 2008).

Rather than actual fluctuation in supply and demand, the oil commodities market appeared to react purely to speculation. As other investments soured, traders pumped in more cash to oil markets, causing further increases. As the increases peaked, the bubble burst, and the market sank.

There has been little conjecture that the foes of the United States and its allies have played a role in oil speculation this year, but the mysterious nature of the oil commodity market lends itself to at least the possibility of outside manipulation. Again, groups that might involve themselves in oil commodity speculation could profit by having inside information about future supplies of oil.

Leading the fight
Wheeler said that the U.S. Department of the Treasury is the leading government organization involved in the battle against economic terrorism. Inside Treasury, the Office of Terrorism and Financial Intelligence (TFI) “marshals the department’s intelligence and enforcement functions with the twin aims of safeguarding the financial system against illicit use and combating rogue nations, terrorist facilitators, weapons of mass destruction (WMD) proliferators, money launderers, drug kingpins, and other national security threats.” (TFI, 2008)

Also within Treasury, the Office of Foreign Asset Control (OFAC) “administers and enforces economic and trade sanctions based on US foreign policy and national security goals against targeted foreign countries, terrorists, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction. OFAC acts under Presidential wartime and national emergency powers, as well as authority granted by specific legislation, to impose controls on transactions and freeze foreign assets under US jurisdiction” (OFAC, 2008).

Another office within Treasury is the Financial Crimes Enforcement Network (FinCEN), which was established in 1990 “to provide a government-wide multisource financial intelligence and analysis network. The organization’s operation was broadened in 1994 to include regulatory responsibilities for administering the Bank Secrecy Act, one of the nation’s most potent weapons for preventing corruption of the U.S. financial system” (FinCEN, 2008).

With world financial markets in a fragile state, the United States and its allies will be watching the financial crisis closely. All those who work in the public and private sectors should be vigilant and ready to recognize that adversaries have the capability of wielding tactics that are both sophisticated and subtle.

References
9/11 Commission. (2004). The 9/11 Commission Report. Washington, D.C.: U.S. Government Printing Office.

Baum, C. (2008). World is “drowning in oil” (Again) after drought. Retrieved October 28, 2008, from http://www.bloomberg.com/apps/news?pid=20601039&refer=columnist_baum&sid=aZ_wEtBdohjM

Bruno, G. (2008). The Evolution of Cyber Warfare. Retrieved October 24, 2008, from http://www.cfr.org/publication/15577/evolution_of_cyber_warfare.html

CBS Evening News. (2001). Profiting From Disaster? Investigators Checking On Unusual Trading In Stock Options. Retrieved October 21, 2008, from http://www.cbsnews.com/stories/2001/09/19/eveningnews/main311834.shtml

Financial Crimes Enforcement Network (FinCEN). (2008). What We Do. Retrieved October 28, 2008, from http://www.fincen.gov/about_fincen/wwd/

Harris, S. (2008). Officials worry about safety of financial data. Retrieved 10/23/2008, from http://www.govexec.com/dailyfed/1008/101708nj1.htm

Markoff, J. (2008). Web becomes a battleground in Russia-Georgia conflict. Retrieved October 24, 2008, from http://www.iht.com/articles/2008/08/12/europe/cyber.php

Office of Foreign Assets Control. (2008). U.S. Treasury - Office of Foreign Assets Control. Retrieved October 28, 2008, from http://www.ustreas.gov/offices/enforcement/ofac/

Office of Terrorism and Financial Intelligence. (2008). U.S. Treasury—Office of Terrorism and Financial Intelligence (TFI). Retrieved October 28, 2008, from http://www.ustreas.gov/offices/enforcement/