© 2013 IBM Corporation1 IBM Confidential
Twitter based stock manipulation rising rapidly
© 2013 IBM Corporation2 IBM Confidential
http://www.telegraph.co.uk/finance/newsbysector/banksandfinance/9911886/FBI-joins-forces-with-SEC-on-computer-trading.html
• Virtually all major areas of the SEC are using analytics
• The office of compliance, examinations and inspections houses a ‘quantitative analytics unit’
• It is staffed with experts in areas of data science, mathematics, physics and computer science
• The FBI has declined to provide details but it is in this unit that scrutiny is being given to computer based high frequency trading (HFT)
Some high speed algorithms are triggered to automatically execute trades when strong positive or negative news appears. Criminals can take advantage by posing as legitimate broker/advisors and posting fake tweets to manipulate specific stocks
© 2013 IBM Corporation3 IBM Confidential
For more than an hour fraudulent tweets remained live on Burger King’s hacked twitter account. False tweets included claims that the company had been sold to McDonalds as well as ‘outrageous’ statements about BK’s company practices and employee behavior. Twitter ultimately shut down the account at the request of Burger King
http://articles.chicagotribune.com/2013-02-19/business/ct-burger-king-twitter-hack-0219-20130218_1_tweets-mcdonalds-hack/
© 2013 IBM Corporation4 IBM Confidential
http://www.huffingtonpost.com/2013/02/01/twitter-stock-market-hoax_n_2601753.html
Fake tweets featuring the well known logo of Muddy Waters Research caused a major sell off. 300,000 shares changed
hands in 2 minutes (while average daily vol is only about 200,000) Algorithms designed to react on neg. or pos. news may have automatically initiated selling before humans took corrective action
© 2013 IBM Corporation5 IBM Confidential
http://www.foxbusiness.com/technology/2013/02/20/sec-on-guard-as-securities-swindlers-take-to-twitter//
“$SRPT FDA steps in as its 48 weeks results on Eteplirsen results are tainted and have been doctored they believe Trial papers seized by FDA.”
The above fake tweet caused Sarepta to drop 9.9% with 700,000 shares changing hands in one minute…even though the phony Citron account had only 6 followers
http://moneymorning.com/2013/03/11/how-social-media-stock-scams-could-put-your-money-at-risk///
© 2013 IBM Corporation6
SEC Detailed Overview of Anti-manipulation Flow
Computer analysis of
complaints, tips, social media
etc
Centralized database
Trading and Markets
CAT real-time (consolidated
audit trail) monitoring
system
Office of Analytics and Research
Enforcement
Office of Market Intelligence
analysts investigators
Key actors
Systems/Tools
Overarching Analytics by Division
MIDAS (market information data analytics system)
Quick cancel HFT algos
Mis-matched trade volumes
Anomalous trading patterns
Sell-side/buy- side info sharing
systems
Enforcement division
Office of Compliance, Inspection & Examination
Third party reviews/audits
Analyze for
Quantitative Analytics Unit
Compliance
Refer to Investigtate via Resolve with
False news via social media
Surprise exams
FBI, DOJ, DHS or other
agencies
Special agents
Deeper analysisSpecialized
analysts
Multiple agency collaboration
Fines
License loss or suspension
Settlements
Indictment and trial
Conviction
Origin/ID trace
© 2013 IBM Corporation7
SEC Pursuit of Stock Manipulation via Twitter
Computer analysis of
complaints, tips, social media
etc
Centralized database
Trading and Markets
CAT real-time (consolidated
audit trail) monitoring
system
Office of Analytics and Research
Enforcement
Office of Market Intelligence
analysts investigators
Key actors
Systems/Tools
Overarching Analytics by Division
MIDAS (market information data analytics system)
Big increases in tweet volume
Uptick in advice/news for thin trade stocks
Misspelling or look-alike of pro
twitter names
Enforcement division
Office of Compliance, Inspection & Examination
Third party cooperation
Analyze for
Quantitative Analytics Unit
Compliance
Refer to Investigtate via Resolve with
Known bad actors off-shore
and domestic FBI, DOJ, DHS or other
agencies
Special agents
Deeper analysis
Specialized analysts
Multiple agency collaboration
Int‘l sanction
License loss or suspension
Arrest/charge
Trial/conviction
Geo origin and ID trace Alerts/trade
haltFines
Hijacked accts
© 2013 IBM Corporation8 IBM Confidential
SEC Use Case: Stock Manipulation using Twitter
Actors: • SEC analysts, investigators, agents,
investors, auditors, other third parties• Inter-Agency analysts, investigators Systems: • Centralized database• MIDAS (market information data analytic
system)• CAT (consolidated audit trail) system• Automated analysis of tips, complaints
Actors and Systems
Inputs• Continuous twitter feed analysis• Real-time trading data• Tips, complaints in central dbOutputs• Correlation of vol increases in
thinly traded stocks on tweet news• New, suspicious twitter handles• Hijacked twitter account alerts• Correlation to known bad actors
Inputs and Outputs
This use case describes how the SEC might uncover and pursue potential twitter based market manipulation. It presents options currently available (and in development) for analysts, officers and investigators. The adoption of analytics at the SEC has become more aggressive in response to the dominant role analytics now plays in the stock market. Tools such as twitter are increasingly used to manipulate trade activity.
Scope Description
• Centralized database systems collect 400+GB of data a day creating a rich resource for advanced analytics
• Streaming real-time data from all 13 exchanges
• Analytic units present in every division• Significant increase in trained analysts• Embedded agents from other agencies
Pre Conditions
• Correlate unexpected trade volume fluctuations to stock-specific tweets
• Coordinate with other agencies to analyze suspicious twitter activity
• Seek ID and origin of suspect tweets• Coordinate with twitter to halt account• Updates markets with accurate news
Post Conditions
1. A sudden increase in news or advisory tweets about a specific stock (usually thinly traded) is detected
2. A correlation is made between the increased tweet volume and an unexpected increase in trading volume for the stock
3. Coordination with twitter (and other third parties) generates information about the suspect messaging activities and raises the alert that fraudulent market manipulation may be taking place.
4. Collaborative analysis seeks identification of the tweet owner and the origin(s) of the messages.
5. Trading of stock may be halted while investigation and analysis occurs
6. Twitter may block and suspend the offending account(s)
7. SEC coordinates with the affected company to update investors and markets with accurate information
8. If the person(s) tweeting false news can be identified they may be questioned, arrested or charged
9. Ultimately they may be fined or otherwise more severely penalized
Basic Flow of Events