CyberWar & The False Comfort Of Mutually Assured Destruction
During a recent financial war-game exercise at the Pentagon, I recommended that the SEC and New York Stock Exchange buy a warehouse in New York and equip it with copper-wire hardline phones, handheld battery-powered calculators, and other pre-Internet equipment. This facility would serve as a nondigital stock exchange with trading posts.
The SEC would assign 30 major stocks each to the 20 largest broker-dealers, who would be designated specialists in those stocks. This would provide market making on the 600 largest stocks, covering more than 90% of all trading on a typical day.
Orders would be phoned in on the hardwire analog phone system and put up for bids and offers by the specialists to a crowd of live brokers. This is exactly how stocks were traded until recently. Computerized and algorithmic trading would be banned as nonessential. Only real investor interest would be represented in this nondigital venue.
In the event of a shutdown of the New York Stock Exchange by digital attack, the nondigital exchange would be activated. The U.S. would let China and Russia know this facility existed as a deterrent to a digital attack in the first place.
If our rivals knew we had a robust nondigital Plan B, they might not bother to conduct a digital attack in the first place.
Russia Strikes the Nasdaq
Financial warfare attacks vary in their degree of sophistication and impact. At the low end of the spectrum is a distributed denial of service (DDoS) attack. This is done by flooding a targeted server with an overwhelming volume of message traffic so that either the server shuts down or legitimate users cannot gain access. In such attacks, the target is not actually penetrated, but it is disabled by the message traffic jam.The next level of sophistication is a cyberhack, in which the target, say, a bank account record file or a stock exchange order system, is actually penetrated. Once inside, the attacking cyberbrigade can either steal information, shut down the system, or plant sleeper attack viruses that can be activated at a later date.
In 2010, the FBI and Department of Homeland Security located such an attack virus planted by Russian security services inside the Nasdaq stock market system. You have probably noticed that unexplained stock market outages and flash crashes are happening with increasing frequency. Some of these events may be self-inflicted damage by the exchanges themselves in the course of software upgrades, but others are highly suspicious and the exact causes have never been disclosed by exchange officials.
A recently revealed classified map showing cyberattacks by the Chinese government against U.S. interests. Notice the concentration of attacks against technology targets in San Francisco, financial targets in New York, and military and intelligence targets in the Washington-Virginia area.
The most dangerous attacks of all
are those in which the enemy penetrates a bank or stock exchange not to
disable it or steal information but to turn it into an enemy drone. Such
a market drone can be used by attackers for maximum market disruption
and the mass destruction of Americans’ wealth, including your stocks and
savings.
In this scenario, an attacker could penetrate the order entry system
of a major stock exchange such as the New York Stock Exchange or one of
the order-matching dark pools operated by major investment banks, such
as the SIGMA X system controlled by Goldman Sachs. Once inside the order
entry system, the attacker would place large sell orders on highly
liquid stocks such as Apple or Facebook.Other system participants would then automatically match these orders in the mistaken belief that they were real trades. The sell orders would keep flooding the market until eventually other participants lowered their bids and began to deflect the selling pressure to other exchanges.
An attack of this type would be launched on a day when the market was already down 3% or more, about 550 points on the Dow Jones index. Using exogenous events like that to increase the power of a planned attack is called a “force multiplier” by military strategists.
The result could be a market decline of 20% or more in a single day, comparable to the stock market crash of October 1987 or the crash of 1929. You would not have to trade anything or be in the market during the attack; you would be wiped out based on the market decline even if you did nothing.
The False Comfort of Mutually Assured Destruction
Another type of highly malicious attack is
to penetrate the account records system of a major bank and then
systematically erase account balances in customers’ deposit accounts and
401(k)s. If the attack extended to backup databases, you or other
customers might have no way of proving you ever owned the deleted
accounts.
Some analysts respond to such scenarios by saying that the U.S. has
cyberwarfare attack capabilities that are just as effective as our
enemies’. If Iran, China, or Russia ever launched a cyberfinancial
attack on the U.S., we could retaliate.
The threat of retaliation, they
claim, would act as a deterrent and prevent the enemy attack in the
first place. This is similar to the doctrine of “mutually assured
destruction,” or MAD, that prevented nuclear conflict between the U.S.
and Russia during the Cold War.
This analysis is highly flawed and gives false comfort.
MAD worked during the Cold War because both sides wanted to avoid
existential losses. In financial warfare, the losses may be existential
for the U.S., but this is not true for Russia, China, and Iran. Because
they are far less developed than the U.S., their markets could be
destroyed and it would have little impact on their overall economy or
national security.Many stocks in Russia and China are owned by U.S. and European investors, so any damage would come back to haunt Western interests.
The technological warfare capabilities may be symmetric, but the potential damage is asymmetric, so the deterrent effect on China and Russia is low. There is essentially nothing stopping Russia, Iran, or China from launching a “first strike” financial warfare attack if it serves some other national strategic purpose.
Be Prepared
What can you do to preserve wealth when these cyberfinancial wars break out?
The key is to have some portion of your total assets invested in
nondigital assets that cannot be hacked, wiped out or disrupted by
financial warfare.Such assets include gold, silver, land, fine art, and private equity that is usually represented by a paper contract and does not rely on electronic-exchange trading for liquidity.
For gold, I recommend you have a 10% allocation to physical gold if you don’t already.
As an investor, you have enough to be concerned about just taking into account factors like inflation, deflation, Fed policy, and the overall state of the economy. Now you have another major threat looming – financial warfare, enabled by cyberattacks and force multipliers. The time to take defensive action by acquiring some nondigital assets is now.
No comments:
Post a Comment