alain
Older and Wiser
- Joined
- 3/29/04
- Messages
- 2,767
- Points
- 93
Correction, hedge fund traders usually play with they are own money and the partners money... and if they fail, they have to recover the loses before they take a penny.
Nick Leeson - 2 (a trader looses $7.16 billion)
- Thread starter Uncle Max
- Start date
Correction, hedge fund traders usually play with they are own money and the partners money... and if they fail, they have to recover the loses before they take a penny.
- Joined
- 5/2/06
- Messages
- 12,266
- Points
- 273
A very interesting piece by our Dominic Cornor. He hits many points right on. Read the comments section for kicks.
Original URL: http://www.theregister.co.uk/2008/01/31/kerviel/
How to lose $7.2bn with just a few Basic skills
By Dominic Connor
Published Thursday 31st January 2008 12:01 GMT
Special report As I swept through Kent and Calais on a Eurostar last week, the financial markets again threw some entertainment my way in the shape of the SocGen debacle.
My last Reg piece (http://www.regdeveloper.co.uk/2008/01/21/vba_office_victory/) explained that the credit crunch (http://www.theregister.co.uk/2007/09/07/derivative_modelling/) was partly fuelled by VBA and that is what appears to have happened again.
However, Eurostar trains don't have Wi-Fi, and my only access to the world was a BlackBerry. So getting Kerviel's number took hours, by which time he had gone to ground. He has my mobile number if he wants a chat...
Nevertheless, in various Paris bars over the weekend, fragments of the story grew in the telling. There were a few common threads, but the consensus was not surprise that this had happened - just that it happened to SocGen, which has an enviable reputation throughout the market as a "smart" bank.
Absolutely no trader or quant has said to me "couldn't happen at my bank". A couple of sharp risk managers correctly speculated that the numbers involved would grow, and that because he had compromised the systems no honest final number would be available soon. Since it appears that it was an external source who complained about the problem, not SG risk management, this seems highly credible.
SG say it is going to sue Kerviel, but according to the lawyer I was travelling with, this could be a six year case if he makes a fight of it. His low rank meant that none of the traders seemed to know him personally, implying that the great bank had been bitten hard by a junior henchman, and he had dug himself in a hole in an attempt to claw himself up from a 75K entry level package.
Most of the media have yet to pick up on the fact that he was supposed to be an arbitrageur, someone who makes riskless profits by spotting things that have been given the wrong price. Instead he bet on prices going up and down. One idea that caused much merriment late Saturday on the Ile Saint-Louis is that his work was deemed to be so low-risk that no one looked all that hard at it.
Oh how we laughed.
Another reassuringly expensive lawyer held the underyling cause to be the "tick box" mentality, whereby every bank produces a thick "compliance manual" which no one ever reads; part of a process where people do what they are told rather than think.
Market Impact
More than one person pointed out that SocGen were likely to lose money just to get out of this mess, as banks spend good money on "market impact models"; confections of hard maths that try to avoid your bidding up prices against yourself. Also, they would be forced to offload regardless of market conditions, so this may end up more expensive than the original foulup.
Qui est cet homme?
No less a figure than the President of the Bank of France called M. Kerviel a "computer genius", which is frankly just about as silly as M. Noyer's apparently blind acceptance of the lines fed to him by SocGen. One can only speculate on what else he has swallowed in this matter. SG's CEO Daniel Bouton referred to Kerviel as a "mutating virus", to bolster the notion of a hi-tech attack by the love child of Lex Luthor and Bill Gates.
But I headhunt people for the high end of banking, and Kerviel's CV (http://www.telegraph.co.uk/money/graphics/2008/01/24/bcnjerome125big.gif) is not that of a BOFH. We have quite literally hundreds of PhDs on our books from quantum physics through exotic mathematics, incomprehensible dealings in game theory, and bleeding edge programming in F#, to cruel and unusual C++. A few have made serious money out of poker. Some are fighter pilots. In this field a bit of VBA does not impress.
But I can infer he was a superior tactical programmer because he was promoted out of the wilderness, which implies he can work hard, and so commands some respect. He might have downloaded some scareware, but the idea that he did any hardcore hacking seems like a fanciful attempt to make SG look less negligent. No one would blame a bank that was raided by heavily-armed special forces, but SG was in effect taken by the man who mends their guns.
Je pense que...
I used to be head of IT at a city firm, was director in charge of the British government's secure network to monitor investment banks, and have done time as a tactical developer in several banks, but not SocGen. So the rest of this piece is inference spiced with direct personal communications as a headhunter with people who discreetly shared unattributable insights over fine wine or shouted them across mediocre lager. Short version: This is informed guesswork.
There have been the inevitable articles on "warning signs" that should have been spotted, and it's hard to argue with that. But to put that into context, everyone who has worked in trading firms has seen position reports that imply that you've accidentally bought up Microsoft, swapping it for your stake in SCO and an option to buy a goat.
Kerviel could explain these signals away because he had worked in the mid office responsible for risk management. When asked why he apparently had a huge position, he would easily have been able to say "sorry, when we built that report, we got it wrong in the way we handle failed trades", and maybe even offer to fix it. For a given value of "fix", of course. Certainly he would have enough excuses to get over the head of a manager chosen on the golf course (you know who you are).
How many passwords would you like M. Kerviel?
SG's official statement claims he stole passwords, but this is highly unlikely to be entirely true. As a mid-office developer he'd be freely given a pile of passwords and access rights. I would actually be quite surprised if all of these were taken away when he was promoted; and as for the passwords of his colleagues, they are shared far more often than the security policy of any bank would permit. I have seen junior staff on trading floors told to log on as other people (no, I'm not saying where, but it's common). The way it works at most firms is that as his new job required more access, this would have been added to his profile, but no one would have asked whether he should be taken off the mid-office servers.
Many organisations deal with "permission creep" by randomly deleting access every year or so, and waiting for people to complain (yes really, it's not just your firm, happened to me more than once). But a common bad technique is to embed usernames and passwords into applications, especially Excel report sheets. These tend to be powerful administrator or developer accounts, granting unlimited access with little or no auditing. I have seen what happens when these accounts are deleted without asking the developer, and it is not pretty. Who, me? Would I do such a thing?
Of course this rarely happens to "important" people, and the food chain at most investment banks has even junior traders like Kerviel in the top tier, so I'd bet money no one even asked why he still had the old access rights. Realistically, being able to do extra useful things and sort out problems with "lower" areas would have made him a more valued member of the trading team, so anyone trying to take his access away would therefore have had a fight on their hands. Such is the menial position of IT in most firms, most would not even try.
Assuming all of this, there are several classical ways he could have hidden what he was up to armed only with VBA, Walkenbach (Wilmott | Serving The Quantitative Finance Community | Bookshop) and the right passwords. Marking trades as having been done by someone else is the most obvious, yet not entirely trivial to stop. A critical requirement of trading systems is to allow others to handle your position when you are off sick or on holiday, creating a set of vulnerabilities. My information is that he may have exploited this, and avoided being away from the office in a way quite atypical for French workers (The Daily Mash - FRENCH TRADER WAS FORCED TO WORK 30 HOURS A WEEK) to avoid being caught.
London firms have a rule that one is supposed to take a block of at least two weeks every year, but it's hardly enforced, and of course US workers hardly get any annual leave at all. SG is known to use SunGard risk management software; but as with all such systems, if you have the right passwords you can make it say what you want. SunGard is much like other risk systems - basically a big expensive reporting tool. It cannot stop you making trades, and although it is technically possible to hook up risk to trading systems to physically halt trading, I've never heard of this being applied across a bank because of the pain it would cause. So Kerviel's claim that other traders also broke their limits is entirely credible, since even the most careful traders accidentally do this occasionally, and of course admit to "temporarily" stepping over these boundaries.
His other claim that his bosses knew also makes some sense since they will have received limit reports, but in the blizzard of tick-box generated reports that infest banks, they may have missed it. However, it defies belief that they'd allow a position of this size by a junior trader, unless the systems were feeding them bogus numbers.
It is possible that he "upgraded" the report spreadsheets that would have caught him, since at most firms they are not secured, and can be changed by anyone in the department. Often this just results in ghastly errors (http://www.eusprig.org/#DOWNLOADS) , but they can be used for darker deeds. Some banks use products like Xenomorph (Xenomorph - Transforming Data Management) to seal and manage spreadsheets, but most just hope for the best.
His VBA skills would have helped him a lot to keep the illusion alive. Traders hit spreadsheet problems so hard that I've helped a couple of banks build teams of thick-skinned Excel jockeys who can hack them into shape in real time under pressure - but most banks do not have these, so you have untrained people helping each other. Knowing Excel, he would have been asked to sort out his colleagues' spreadsheets, and left sitting at their PCs able to execute any number of misdeeds while his colleague went off for lunch. That covers the claims that he intercepted emails and carried out all sorts of technomancy on the risk systems without using a network sniffer or hacking the Windows kernel.
Could it happen here ?
France and Britain represent the opposite poles of regulation. Under EU tutelage Paris passes market laws which are policed "politically", i.e. not on important French companies, while the British FSA applies gold-plated regulations with a staff so underpaid that they can't hire the right level of people. But the technology and business logic is identical in London, NY, and Paris - so of course it is in no way limited to the French way of banking. ®
Original URL: http://www.theregister.co.uk/2008/01/31/kerviel/
How to lose $7.2bn with just a few Basic skills
By Dominic Connor
Published Thursday 31st January 2008 12:01 GMT
Special report As I swept through Kent and Calais on a Eurostar last week, the financial markets again threw some entertainment my way in the shape of the SocGen debacle.
My last Reg piece (http://www.regdeveloper.co.uk/2008/01/21/vba_office_victory/) explained that the credit crunch (http://www.theregister.co.uk/2007/09/07/derivative_modelling/) was partly fuelled by VBA and that is what appears to have happened again.
However, Eurostar trains don't have Wi-Fi, and my only access to the world was a BlackBerry. So getting Kerviel's number took hours, by which time he had gone to ground. He has my mobile number if he wants a chat...
Nevertheless, in various Paris bars over the weekend, fragments of the story grew in the telling. There were a few common threads, but the consensus was not surprise that this had happened - just that it happened to SocGen, which has an enviable reputation throughout the market as a "smart" bank.
Absolutely no trader or quant has said to me "couldn't happen at my bank". A couple of sharp risk managers correctly speculated that the numbers involved would grow, and that because he had compromised the systems no honest final number would be available soon. Since it appears that it was an external source who complained about the problem, not SG risk management, this seems highly credible.
SG say it is going to sue Kerviel, but according to the lawyer I was travelling with, this could be a six year case if he makes a fight of it. His low rank meant that none of the traders seemed to know him personally, implying that the great bank had been bitten hard by a junior henchman, and he had dug himself in a hole in an attempt to claw himself up from a 75K entry level package.
Most of the media have yet to pick up on the fact that he was supposed to be an arbitrageur, someone who makes riskless profits by spotting things that have been given the wrong price. Instead he bet on prices going up and down. One idea that caused much merriment late Saturday on the Ile Saint-Louis is that his work was deemed to be so low-risk that no one looked all that hard at it.
Oh how we laughed.
Another reassuringly expensive lawyer held the underyling cause to be the "tick box" mentality, whereby every bank produces a thick "compliance manual" which no one ever reads; part of a process where people do what they are told rather than think.
Market Impact
More than one person pointed out that SocGen were likely to lose money just to get out of this mess, as banks spend good money on "market impact models"; confections of hard maths that try to avoid your bidding up prices against yourself. Also, they would be forced to offload regardless of market conditions, so this may end up more expensive than the original foulup.
Qui est cet homme?
No less a figure than the President of the Bank of France called M. Kerviel a "computer genius", which is frankly just about as silly as M. Noyer's apparently blind acceptance of the lines fed to him by SocGen. One can only speculate on what else he has swallowed in this matter. SG's CEO Daniel Bouton referred to Kerviel as a "mutating virus", to bolster the notion of a hi-tech attack by the love child of Lex Luthor and Bill Gates.
But I headhunt people for the high end of banking, and Kerviel's CV (http://www.telegraph.co.uk/money/graphics/2008/01/24/bcnjerome125big.gif) is not that of a BOFH. We have quite literally hundreds of PhDs on our books from quantum physics through exotic mathematics, incomprehensible dealings in game theory, and bleeding edge programming in F#, to cruel and unusual C++. A few have made serious money out of poker. Some are fighter pilots. In this field a bit of VBA does not impress.
But I can infer he was a superior tactical programmer because he was promoted out of the wilderness, which implies he can work hard, and so commands some respect. He might have downloaded some scareware, but the idea that he did any hardcore hacking seems like a fanciful attempt to make SG look less negligent. No one would blame a bank that was raided by heavily-armed special forces, but SG was in effect taken by the man who mends their guns.
Je pense que...
I used to be head of IT at a city firm, was director in charge of the British government's secure network to monitor investment banks, and have done time as a tactical developer in several banks, but not SocGen. So the rest of this piece is inference spiced with direct personal communications as a headhunter with people who discreetly shared unattributable insights over fine wine or shouted them across mediocre lager. Short version: This is informed guesswork.
There have been the inevitable articles on "warning signs" that should have been spotted, and it's hard to argue with that. But to put that into context, everyone who has worked in trading firms has seen position reports that imply that you've accidentally bought up Microsoft, swapping it for your stake in SCO and an option to buy a goat.
Kerviel could explain these signals away because he had worked in the mid office responsible for risk management. When asked why he apparently had a huge position, he would easily have been able to say "sorry, when we built that report, we got it wrong in the way we handle failed trades", and maybe even offer to fix it. For a given value of "fix", of course. Certainly he would have enough excuses to get over the head of a manager chosen on the golf course (you know who you are).
How many passwords would you like M. Kerviel?
SG's official statement claims he stole passwords, but this is highly unlikely to be entirely true. As a mid-office developer he'd be freely given a pile of passwords and access rights. I would actually be quite surprised if all of these were taken away when he was promoted; and as for the passwords of his colleagues, they are shared far more often than the security policy of any bank would permit. I have seen junior staff on trading floors told to log on as other people (no, I'm not saying where, but it's common). The way it works at most firms is that as his new job required more access, this would have been added to his profile, but no one would have asked whether he should be taken off the mid-office servers.
Many organisations deal with "permission creep" by randomly deleting access every year or so, and waiting for people to complain (yes really, it's not just your firm, happened to me more than once). But a common bad technique is to embed usernames and passwords into applications, especially Excel report sheets. These tend to be powerful administrator or developer accounts, granting unlimited access with little or no auditing. I have seen what happens when these accounts are deleted without asking the developer, and it is not pretty. Who, me? Would I do such a thing?
Of course this rarely happens to "important" people, and the food chain at most investment banks has even junior traders like Kerviel in the top tier, so I'd bet money no one even asked why he still had the old access rights. Realistically, being able to do extra useful things and sort out problems with "lower" areas would have made him a more valued member of the trading team, so anyone trying to take his access away would therefore have had a fight on their hands. Such is the menial position of IT in most firms, most would not even try.
Assuming all of this, there are several classical ways he could have hidden what he was up to armed only with VBA, Walkenbach (Wilmott | Serving The Quantitative Finance Community | Bookshop) and the right passwords. Marking trades as having been done by someone else is the most obvious, yet not entirely trivial to stop. A critical requirement of trading systems is to allow others to handle your position when you are off sick or on holiday, creating a set of vulnerabilities. My information is that he may have exploited this, and avoided being away from the office in a way quite atypical for French workers (The Daily Mash - FRENCH TRADER WAS FORCED TO WORK 30 HOURS A WEEK) to avoid being caught.
London firms have a rule that one is supposed to take a block of at least two weeks every year, but it's hardly enforced, and of course US workers hardly get any annual leave at all. SG is known to use SunGard risk management software; but as with all such systems, if you have the right passwords you can make it say what you want. SunGard is much like other risk systems - basically a big expensive reporting tool. It cannot stop you making trades, and although it is technically possible to hook up risk to trading systems to physically halt trading, I've never heard of this being applied across a bank because of the pain it would cause. So Kerviel's claim that other traders also broke their limits is entirely credible, since even the most careful traders accidentally do this occasionally, and of course admit to "temporarily" stepping over these boundaries.
His other claim that his bosses knew also makes some sense since they will have received limit reports, but in the blizzard of tick-box generated reports that infest banks, they may have missed it. However, it defies belief that they'd allow a position of this size by a junior trader, unless the systems were feeding them bogus numbers.
It is possible that he "upgraded" the report spreadsheets that would have caught him, since at most firms they are not secured, and can be changed by anyone in the department. Often this just results in ghastly errors (http://www.eusprig.org/#DOWNLOADS) , but they can be used for darker deeds. Some banks use products like Xenomorph (Xenomorph - Transforming Data Management) to seal and manage spreadsheets, but most just hope for the best.
His VBA skills would have helped him a lot to keep the illusion alive. Traders hit spreadsheet problems so hard that I've helped a couple of banks build teams of thick-skinned Excel jockeys who can hack them into shape in real time under pressure - but most banks do not have these, so you have untrained people helping each other. Knowing Excel, he would have been asked to sort out his colleagues' spreadsheets, and left sitting at their PCs able to execute any number of misdeeds while his colleague went off for lunch. That covers the claims that he intercepted emails and carried out all sorts of technomancy on the risk systems without using a network sniffer or hacking the Windows kernel.
Could it happen here ?
France and Britain represent the opposite poles of regulation. Under EU tutelage Paris passes market laws which are policed "politically", i.e. not on important French companies, while the British FSA applies gold-plated regulations with a staff so underpaid that they can't hire the right level of people. But the technology and business logic is identical in London, NY, and Paris - so of course it is in no way limited to the French way of banking. ®
