On Monday 7 January 2008 a daily risk report at Société Générale showed an exposure to one counterparty so large that staff suspected an error. It came from eight forward trades booked by Jérôme Kerviel, a trader on the bank's Delta One desk in Paris, whose eight traders shared a net exposure limit of €125 million. Asked about them by a member of a support team, he gave an explanation that the staff member later admitted not having understood, and on the 9th he cancelled them. On 15 January they resurfaced in the bank's regulatory capital calculation. On the 17th he named another counterparty; on the 18th he sent a forged document to support it. That evening a manager proposed simply telephoning the counterparty. On Saturday a call showed the trade did not exist.
Over the weekend twenty staff searched his books and found long positions on European stock-index futures of nearly €50 billion, more than the bank's entire capital. Société Générale closed them from Monday 21 to Wednesday 23 January, in secret and in falling markets, and on Thursday 24 January announced a loss of €4.9 billion and a €5.5 billion capital increase. By its inspectors' later reckoning the unwinding had lost €6.4 billion, offset by a €1.5 billion profit he had hidden at the end of 2007. Kerviel, 31 on 11 January, had joined the bank in 2000 and worked in its middle office, which records traders' deals and makes the first checks on them, before moving to trading in 2005; the bank said he had used his knowledge of its controls.
The bank's General Inspection set out his methods in May. He booked trades that offset his real positions, then cancelled them before anyone confirmed or settled them, 947 by its count: forwards with deferred start dates, confirmed only days before they began; deals with an in-house subsidiary, reconciled monthly; trades against placeholder counterparties such as "pending". He hid profits with provisions, checked only at month's end. The inspectors counted 74 alerts, e-mails in which control staff raised an anomaly in his trades, 39 directly linked to the fraud; each was closed with an explanation, a cancellation or, seven times, a forged e-mail. Nothing in operations examined cancelled trades or large nominal amounts. Eurex had queried his trading twice in November 2007, and a manager had four times raised his reluctance to take holidays.
What exposed him was a regulatory capital calculation, not a fraud control. In July 2008 the Commission bancaire reprimanded the bank and fined it €4 million, finding control failings that had made the fraud possible. On 5 October 2010 a Paris court convicted Kerviel of breach of trust, forgery and fraudulently entering data into a computer system, gave him five years, two suspended, and ordered him to repay €4.9 billion; the appeal court agreed in October 2012. On 19 March 2014 the Cour de cassation upheld the conviction but quashed the damages: the bank's faults had contributed to the fraud and its cost. He served less than five months, in 2014. On 23 September 2016 the Versailles appeal court, finding him only partly responsible, set his debt at €1 million.
Floods, Then Masks
On 14 January 2008 a Church of Scientology video, an interview with Tom Cruise, appeared on YouTube, which removed it under threat of litigation. A loose internet group calling itself Anonymous answered. From about 18 January the Church's websites went down intermittently for at least a week; on 21 January a video announcing the campaign was posted to YouTube, and scientology.org moved to Prolexic, a mitigation service. Arbor Networks measured floods of up to 220 megabits a second, some starting and stopping on banks of machines at the same instant: "there have definitely been bots employed", said Arbor's Danny McPherson. Sympathisers were also told to run flooding software, make nuisance calls and fax black pages. On 10 February the campaign went to the street: by press counts about 7,000 people protested outside Scientology buildings in around a hundred cities, many in Guy Fawkes masks. Two men later admitted joining the floods: a New Jersey man, eighteen when charged, got a year and a day in November 2009, and a Nebraska man who had downloaded the software from an Anonymous message board agreed in January 2010 to serve a year.
Parked Overnight
On 9 January 2008 a laptop was stolen from the car of a junior Royal Navy officer involved in recruiting, left parked overnight in Edgbaston, Birmingham. It held records of about 600,000 new and prospective recruits; for some 153,000 applicants to the Navy, the Royal Marines and the RAF they included passport and National Insurance numbers, driving licence details and doctors' addresses, and for a few thousand, bank details. Ministers were told on 11 January, believing the data encrypted, and learned on the 14th that it was not. The Ministry of Defence disclosed the theft late on 18 January. On the 21st Des Browne, the defence secretary, told MPs that the rules, encryption among them, had not been followed, that two earlier laptop thefts, in 2005 and 2006, had never been reported to ministers, and that it was "not clear" to him why recruiters routinely carried so many details at all. It came two months after HM Revenue and Customs had admitted losing two discs holding the child-benefit records of 25 million people. From April 2010 the Information Commissioner could fine up to £500,000; the first fines came that November.
Last Quarter's Numbers
Shortly after 2.30 pm on Monday 21 January 2008, with the Sensex on its way to a fall of 1,408 points, to 17,605, the Bombay Stock Exchange stopped trading for a brief period. Its spokesman called it a technical snag, not a circuit filter, and its timing a coincidence; SEBI, the market regulator, asked the exchange to explain. The exchanges readjusted their halt levels at the end of every quarter, under a scheme SEBI had set in June 2001: market-wide halts at moves of 10, 15 and 20 per cent in the Sensex or the Nifty, whichever came first, translated into index points from the closing level on the last trading day of each quarter. A 10 per cent fall at or after 2.30 pm was to halt nothing.
The next morning the rule worked as written. Within minutes of the opening on Tuesday 22 January the Sensex was at 15,576.30, down 11.53 per cent, and trading stopped for an hour; it closed 875 points down, at 16,729. In Paris, on both days, Société Générale was quietly selling the futures on this edition's cover. In September 2013 SEBI ordered the exchanges to recalculate the limits every day from the previous close and to reopen after each halt with a call auction; the quarterly readjustment gave way to a daily one. Its cyber-resilience framework for exchanges, clearing corporations and depositories, issued on 6 July 2015, went further: new or modified systems were to be regression-tested, business logic and security controls included, before they went live.
Microsoft bids for Norway's search engine
On 8 January 2008 Microsoft offered 19 Norwegian kroner a share for Fast Search & Transfer, the Oslo company whose ESP platform did the linguistic work behind other firms' search boxes — about 6.6 billion kroner, or $1.2 billion, and a 42 per cent premium to the close on 4 January. FAST's board recommended it unanimously. Jeff Raikes, who ran Microsoft's business division, called enterprise search "an indispensable tool to businesses of all sizes". Two quieter decisions mattered as much. On 23 January the Lucene project management committee and the Apache board voted to promote Hadoop, until then a subproject, to a project of its own; its distributed storage and batch processing became the ordinary way to hold data at scale, and the first machine-learning libraries written for clusters were built on it. On 31 January IBM closed its $5 billion purchase of Cognos, its largest acquisition to that date. Norway's economic-crime police raided FAST that October; its founder, convicted in 2014 of accounting irregularities and market manipulation, denied the charges.
Mebroot rewrites the boot sector
On 9 January 2008 researchers at iDefense and Symantec described a rootkit that did not live in Windows at all. It overwrote the master boot record, the first sector a machine reads, so its code ran before the operating system loaded and the kernel it hooked could not see it; reinstalling Windows left it in place. Symantec detected it as Trojan.Mebroot; most products missed it. Matthew Richard of iDefense said it subverted "the Windows kernel before it loads". Infections were put at about 5,000 between 12 December and 7 January, served to unpatched browsers from some 30,000 compromised sites, with a banking trojan as the payload. Boot-sector infection was a DOS-era technique the industry had stopped watching; pre-boot scanning returned to product specifications, and the route closed only with UEFI firmware and signed boot loaders. On 17 January F-Secure found MacSweeper, the first rogue cleaner for Mac OS X, which flagged Apple's own iCal and Dashboard and charged $39.99. Symantec reported revenue of $1.52 billion for the December quarter on 23 January, with net income up 13 per cent.
⏳ Time capsule — January 2008
- On 10 January, at the ninth Auto Expo in New Delhi, Ratan Tata unveiled the Nano, a small car with a rear-mounted, two-cylinder engine, at ₹1 lakh before taxes and transport. Input costs had risen steeply since the project began about four years earlier, he said, but he would hold to the price he had promised.
- On 15 January, at Macworld, Steve Jobs drew the MacBook Air from a manila envelope; Apple called it the world's thinnest notebook. It had no optical drive, and its Remote Disc software borrowed another computer's drive wirelessly.
- On 19 January, at the WACA in Perth, India beat Australia by 72 runs and ended their run of 16 consecutive Test wins. Irfan Pathan was player of the match, and R. P. Singh's yorker took the last wicket.
- On 27 January, in Melbourne, Novak Djokovic beat Jo-Wilfried Tsonga 4–6, 6–4, 6–3, 7–6 to win the Australian Open, his first major title and the first by a Serbian man; in the semi-final he had beaten Roger Federer, the two-time defending champion.
Answering the Alarms
Société Générale's remedy, set out in 2016, was to watch what Kerviel had used: the nominal size of positions, deletions of trades and the holidays traders took, under a new department for supervision and operational security. It said it had spent more than €200 million since 2008 on securing its market activities and making them more efficient. Kerviel came to argue that his superiors must have known; the bank denied it, and its inspection had found that they knew neither his methods nor the size of his positions. The figure at its centre recurs through this archive, the insider trusted with a system's controls: San Francisco's network engineer in July 2008, Fannie Mae's departing contractor in October 2008, the Super User identity that hid Satyam's false invoices in January 2009.
The month's other threads run on. The volunteer floods against Scientology became a method; in December 2010 Operation Payback turned them on MasterCard and Visa. On 16 January a CIA analyst, Tom Donahue, told a control-systems security summit in New Orleans that intrusions had disrupted power equipment outside the United States, in at least one case causing an outage across several cities; he named no country, date or culprit, and the first publicly acknowledged cyber-caused blackout came in Ukraine in December 2015. President Bush's classified directive of 8 January, NSPD-54, began the Comprehensive National Cybersecurity Initiative, which his successor, after the review told in May 2009, folded into a wider strategy. Behind this edition the archive runs back through December 2007 to July 2007.