[sXVUOUVC]

Article 2:
http://arstechnica.com/tech-policy/n...ets-beware.ars

Goldman's secret sauce could be loose online; markets beware

The secret program that controls the computer-automated trading desk at the nation's top investment bank has escaped onto the Internet, thanks to a rogue company programmer. But that's just the start of the story, and it's getting stranger still.



A Russian programmer named Sergey Aleynikov was picked up this past Friday by the FBI for allegedly stealing and passing along code that, if circulating out in the wild, could expose US markets to manipulation and cost Aleynikov's former employer, Goldman Sachs, millions. Bloomberg quotes assistant US Attorney Facciponti saying that "there is a danger that somebody who knew how to use this program could use it to manipulate markets in unfair ways. The copy in Germany is still out there, and we at this time do not know who else has access to it."

So how could a 32MB compressed source code archive pose a threat to markets and to America's most powerful investment bank? The story is actually less complex than it may sound.
Recovering the black box

In a nutshell, the "black box" trading platforms of Goldman and other banks use a combination of proprietary, secret algorithms and the fastest hardware available to take in a torrent of news and other market data and generate a stream of trades that are timed to the millisecond. So, instead of operating on the old stock market adage, "buy on the rumor, sell on the news," a high-frequency trading platform like Goldman's will buy a few milliseconds after the news hits, then sell moments later at a very small premium to other traders and platforms who didn't get the news in (or their trades out) quite as fast. Do this billions of times a day, and voila, you're printing money.

Obviously, to make a scheme like this work, you need a few things, one of which is hardware that's at least a few milliseconds faster than everyone else's (see my previous post on the high-frequency trading "arms race"). The second main ingredient is software that, given a set of data inputs, can figure out which trades everyone else is likely to make in response to those same inputs, so that the platform can get there first and be holding those assets when everyone else suddenly decides they want them.

If you have your hands on the code that runs on Goldman's trading platform—again, one of the largest in the world—then you know with 100 percent accuracy which trades Goldman's computers are going to make in response to a given set of inputs. All you need then is even faster hardware so that you can get to those trades just a few milliseconds before Goldman, and you'll always beat the bank and therefore be able to sell to Goldman at a slight premium. Goldman will therefore make less on every trade, since you'll essentially be usurping their place in the pecking order.

When US government prosecutors claim that the release of Goldman's secret sauce could potentially expose markets to manipulation, what they're really saying is that some unknown party could use it to out-manipulate Goldman, and possibly even do something more ambitious like frustrate Goldman's platform so that it fails while simultaneously finding some way to short it. Given that Goldman's platform is one of the main providers of liquidity to the market (i.e., it fills a market function by holding assets that everyone will want shortly, and then selling them to all comers), it would ostensibly be a bad thing if it suddenly blew up.
How Aleynikov did it

The FBI's complaint (PDF) in the case describes how Aleynikov pulled off his heist of the code. During the first five days in June, the programmer, whose LinkedIn profile describes him as VP of Equity Strategy, ran some scripts via a bash shell that copied and compressed a bunch of source code, then sent it out via HTTPS to a German server—about 32MB total over four separate occasions, which is actually quite a lot of compressed ASCII source code.

Aleynikov tried to cover his tracks by having the script erase his bash history, but Goldman's machines actually keep a backup of everyone's bash history, which is how they figured out what he had done. The bank was tipped off by the HTTPS transfers, which seem to have set off some sort of alarm that invited further scrutiny.

The programmer had informed Goldman that he was quitting and going to work for Chicago-based Teza Technologies, LLC, another high-frequency trading shop that has now suspended his employment in the wake of his arrest. He was released on a $750,000 bond today and now awaits trial.

This story is still developing, and I encourage you to read the second half of Matthew Goldstein's Reuters story, which is where the arrest first came to light, to get a sense of where it's headed. (Zero Hedge is also on top of this). In particular, there are a number of very odd twists here, the latest of which makes the New York Stock Exchange look particularly bad.

The NYSE puts out a weekly list of the top program traders by volume, and Goldman typically tops this list by a country mile. Then last week's list came out, and Goldman's name was shockingly absent. And today, now that the code theft story is out, the NYSE has put out a statement claiming that Goldman's absence on the list was the result of a "system error;" it has also released a revised list showing Goldman once again dominating program trading activity.

Needless to say, many econ bloggers are incredulous that the top entrant in the weekly program trading list suddenly went missing last week and nobody at the NYSE caught the error before now, especially given the Aleynikov news and the timing of the "error." Conspiracy theories are legion, and even if none of them are true, it's hard to shake the feeling that this story is about to blow up into a major scandal.

[nabsgood]

There's enough movement into and out of GS that it's impossible to believe that they would rely on stable algorithms to conduct hf trades. Even if you can't bring the code with you it wouldn't be that hard to recreate most of its behaviour when you move to another company. Unless Goldman's been able to enforce draconian non-competes (as in much, much longer than the standard 1-3 months or so) it has to alter its code more frequently than this anyway...

[giturbewan]

Note: I am not yet a quant. I just play one on Poly.

[nuveem7070]

By the way, IIRC this guy's an astrophysicist.

If so, he's got quite an impressive software development background according to his linkedin profile:

SYSTEMS: UNIX/Linux, Windows.
LANGUAGES & FRAMEWORKS: C/C++, STL, Template Metaprogramming, lock-free algorithms, Erlang/OTP, Kylix/Delphi/Pascal, Mono, C#/.NET, F#, OCaml, SQL, PL/SQL, Perl/shell scripting, JavaScript, HTML, XML.
DATABASES: Oracle 7/8i/9i/10g, Sybase, TimesTen, FastDB, GigaBASE, Mnesia.
PROTOCOLS & API: TCP/IP, UDP, SCTP, FIX, Nasdaq ITCH/OUCH, NYSE CCG FIX, SS7/ISUP, SIGTRAN/M3UA, SNMP, SIP, SOAP, TibcoRV, MPI, SMTP, JABBER, JSON, AJAX, Win32, pthreads, futexes, async I/O. He also contributed to many open source Erlang projects, which is pretty exceptionally geeky.

[Peertantyb]

Oops. It's the guy who's in charge of the firm he was jumping ship for that's an astrophysicist (princeton)

[Xewksghy]

I'm more impressed by his $1.2M salary.

[herbalviagra]

I think that I have heard a bit of talk about Renaissance Technologies at the lab, apparently it is one of the firms that employs lots of physicists.

JM

[Sdinozes]

They're usually written in C++ or Java (J2EE).

[TheLucyLee]

What else do you call it when you pop in 2 days after everybody else has already answered my question to repeat a less cogent version of their advice?

[freeringsf]

What the **** basic flaw are you talking about, twit?

[layedgebiamma]

In other words, you have nothing to add, yet you try to make some sort of comment to make it seem as though you have knowledge or judgment that others lack. Just like every time. Dø dit fede Dansk pikfjæs

[jakitula]

a) You are, by far, not the most knowledgable person on poly in this area.
b) When I ask questions they are QUESTIONS. They are not opinions or wild theories which I believe in despite having no evidence for them or understanding of the underlying issue

You have no idea what I react strongly to, my little sweetheart. It's not ignorance. It's WILLFUL ignorance coupled with intellectual certainty and incuriousity.

Dumbass.

[Jesslovers]

I know precisely what you said. And it was exactly the sort of mundane, obvious, self-aggrandizing response I've come to expect from you.

[sandracuk]

Sweetheart, if I felt as though that criticism held even a grain of truth then it would sting, but I've spent most of my life purging whatever vestiges of those qualities I might have been born with.

I meet you with a clear conscience on that front

[NudiJuicervich]

Feel free then. I welcome novel information. Unfortunately, you appear to be a repository of useless adages and meaningless catchphrases. You're a silk stocking full of ****.

Well you started by asking if it was sensible to put everything in the same header file

a) Should all the new classes be defined in the same header file? What if there are multiple authors working on a bunch of classes simultaneously? That really told me all

[pGJLweEw]

That really told me all

What did this tell you, son?

a) It is situation-specific. Java enforces a "one class, one file" rule while C#/C++ do not. But this approach frequently makes sense, particularly when many people are working on the same file. Smaller files, fewer merges. So if more than, say, 3 people may be working on it, that is probably the desirable approach.

???

In other words, Asher confirmed what I had suspected; that the larger and more distributed a project the more you would like headers separated. In a small group, the one big header file is perfectly acceptable.

Please note that he did this in the VERY FIRST RESPONSE.

Then you trotted in a day or two later, repeated what he had said in some sort of obtuse pseudo-nordic fashion and proceeded to proclaim yourself the font from which all wisdom springs.



BC, do you think that your neuroses are hidden from anybody but yourself? You don't NEED to be as smart as me in order to be a good, productive member of society. The machine needs its cogs, my boy.

[Badyalectlawl]

What did this tell you, son?



???

In other words, Asher confirmed what I had suspected; that the larger and more distributed a project the more you would like headers separated. In a small group, the one big header file is perfectly acceptable.

Please note that he did this in the VERY FIRST RESPONSE.

Then you trotted in a day or two later, repeated what he had said in some sort of obtuse pseudo-nordic fashion and proceeded to proclaim yourself the font from which all wisdom springs.



BC, do you think that your neuroses are hidden from anybody but yourself? You don't NEED to be as smart as me in order to be a good, productive member of society. The machine needs its cogs, my boy.

What the hell are you drinking - it must be some serious stuff

Yeah, Asher did said an important thing, but he didn't say a word about reusability wich was what I commented on.

Now, can you remember my advise about finding a sufficient tree ?

Edit: well about the company sending me - I'm not sure that I could find a reason to take a vacation in your vicinity, but I can guarantee an alchoholfilled event including insults if you visit Copenhagen

Poly suck seriously - wonder if this will be a third ?

[BluewayAllere]

Do you really think that because some std library are doing it, then it's also reasonbly for you to do it ?

Explain why not, you silly little man...

God, you're getting pwn3d by a physicist on software design. This is pathetic...

[MexicoCity]

Sweetheart, there are numerous "standard" libraries which release every month or two which are structured in the exact way I just listed.

Nice try, though. You force a recompile when the user chooses to install the newest version. Smallish libraries should not involve recompile times for testing routines which are intolerably long.



We've already discussed this: the larger and more distributed the project, the more encapsulated you want your classes. For reasonably smallish projects there's no issue.

How is any of this different from what Asher mentioned, again?

[rockboyzaza]

We've already discussed this: the larger and more distributed the project, the more encapsulated you want your classes. For reasonably smallish projects there's no issue.

How is any of this different from what Asher mentioned, again?