The power and ubiquity behind spyware
The
US administration – along with governments of other countries – has
been using ever more sophisticated methods of data analysis, designed to
defend and protect its interests and those of its citizens against
foreign cyber attacks and other threats. At least this was the official
story, until Edward Snowden, a former US National Security Agency (NSA)
contractor, made public a significant volume of hitherto secret
intelligence files last month. Mr Snowden’s stunning exposure of US
government documents painted a rather different picture of US cyber
activity on a global scale, including clandestine surveillance, data and
software hijacking as well as aggressive attacks on other states, their
critical infrastructure and their economic competitiveness, arguably
with the potential – in extremis – to bring down large parts of the
world economy. It is likely that few in the international banking
industry are prepared for such an outcome.
Non-American IT
professionals have long suspected that US government agencies had a
healthy disregard for their rights to privacy. Mr Snowden has given the
world a wake up call in this respect. The USA’s various three letter
agencies (FBI, CIA, NSA, DIA) and the UK’s GCHQ, as well as agencies in
Argentina, Brazil, Canada, France, Germany, Italy, Spain, even New
Zealand and Australia have all shown more than a healthy interest in
Swiss private banks. Mr Snowden confirmed that, since 1999, many US
government agencies have been able to penetrate all Microsoft operating
systems. The NSA’s ‘Prism’ surveillance project is alleged by Mr Snowden
to have been operational since 2006.
Up to now, Prism’s main
interest has been to tap into data from network switches, or fibre-optic
cables, rather than to attack individual computers directly. It appears
that the agencies concerned decided it was more expedient to collect
data at the network level, taking all they could obtain from firms such
as Microsoft, Facebook, Verizon, AT&T, Google, Twitter, Apple,
Oracle, Yahoo and Skype (now owned by Microsoft). According to Mr
Snowden, the CEOs of many of these organisations have been actively
collaborating with the US administration for some time.
The US
administration has set its sights on the Swiss private banking sector,
with some significant punitive action, such as the US Internal Revenue
Service (IRS) awarding Bradley Birkenfeld $104 million for outing those
American clients of UBS who were tax cheats, as well as the Department
of Justice’s legal pursuit of Wegelin & Cie, Switzerland’s oldest
bank, causing it to close its doors after more than 200 years. At least
13 other banks are in the firing line.
Mr Snowden has alleged
that these initiatives were apparently just the tip of an iceberg, as
reported on 10th June 2013 in The Guardian, a UK newspaper, where he
describes the entrapment of a Swiss banker in Geneva. The value of
catching some rich tax evaders is nothing when compared to the value of
the proceeds of corporate espionage. Most of the data intercepts have
been tracked back to countries that are economic competitors to the US,
such as China, Germany and India, in high margin industries like
banking, aviation, IT, media and pharmaceuticals. It is conceivable that
any private banker working with clients even remotely connected with
these industries risks harassment, interference, eventually blackmail
(such as in Snowden's example of a certain banker in Geneva), not to
mention poaching of clients and employees by competitors.
Another
problem is that over collection of this data has led to false
positives, such as the UK case of David Mery reported in The Guardian on
22nd September 2005. Despite all charges being dropped against Mr Mery
that year, apparently he is still on file as a potential terrorist and
can no longer obtain a travel visa.
The back-doors to the various
operating systems used in the financial services sector enable the use
of key logging, programmed trade front running, the planting false
evidence and other nefarious acts. Other parts of government and
regulatory machinery appear to be unfit for purpose in providing the
checks and balances one would expect from an effective administration.
For
example, there still has been no adequate explanation for the massive
spike in put and call options in relevant listed companies prior to
September 11th, 2001. According to 911research, a website established to
collate information about the terrorist attack on the World Trade
Center in New York on 11th September 2001, a significant number of
industry professionals were “deputized” by the US authorities to snuff
out any form of disclosure. In other words, they are unable to speak
about what they know, as they now represent the US government.
What
is clear is a certain privileged group made a proverbial killing (see
“The impact of terrorism on financial markets: An empirical study”, by
Marc Chesney, Ganna Reshetar and Mustafa Karaman, Journal of Banking
& Finance – vol. 35, no. 2, pp. 253-267, 2011). The SEC has so far
done little, despite records that show trading volumes increasing by an
unusually large margin. In the case of the NSA and the Foreign
Intelligence Surveillance Court (FISA), for the last three years, these
organisations have approved all government surveillance requests,
excluding four that were withdrawn.
Open democracies or Big Brother states? The answer seems clearThe
laws passed since 2001 allow the US government to enter a US citizen’s
home with a secret warrant (FISA under the Patriot Act) , imprison the
citizen indefinitely at a secret location , try the individual with
secret evidence (again FISA and the Patriot Act) and – just in case
these powers over a US citizen were not enough, it allows them to revoke
US citizenship as a suspected terrorist . With this in mind, how fairly
can non-US citizens expect to be treated?
It is fair to assume
that traffic analysis from the collected meta-data could expose even
judges and journalists, let alone bankers and their clients. This means
the Swiss banking industry should not assume that even a legal solution
is going to be possible. Perhaps banks in other jurisdictions need to
consider what steps they need to take to protect themselves, their
employees and clients.
Recent reports have shown that
surveillance programs have regularly been abused. As well as the
much-publicised News of the World phone hacking scandal in the UK,
Rupert Murdoch’s news empire has also been accused of acting as a global
extension of the Israeli secret service programs for intelligence
gathering, propaganda and political infiltration. Evidently, Murdoch’s
news organization was not simply limited to spying on celebrities. In
the aftermath it has emerged that the initial Scotland Yard
investigators of News Corporation were also bribed, according to reports
in The Guardian.
Other alleged examples of the exploitation of
software ‘back doors’ include the listening in on the Greek prime
minister in 2005, during the preparation of the Olympic bid and the
breach of Google's Gmail by Chinese hackers to unmask political
dissidents.
Perhaps the best example of illicit corporate
surveillance was Nokia, whose mobile browser decrypted all encrypted
traffic from its handset's browser. Nokia diverted all traffic from its
handsets through its own servers, decrypted the encrypted traffic,
re-encrypting it before passing it on, issuing HTTPS certificates on the
fly that the Nokia phone had been instructed to trust as secure.
Deliberate or not, Nokia betrayed its financial services industry
customers, amongst others, by specifically designing its phones to
enable full, unecrypted access to users’ browsing activity without their
knowledge. Nokia was forced to push out a patch to close the
vulnerability, but could just as easily create another one if they
wanted to.
Official information regarding the US-based Prism
program is dubious. In effect, James Clapper, director of US National
Intelligence appears to have perjured himself, by admitting that he gave
an ‘erroneous’ answer to the congressional committees that were
supposed to be overseeing him. This is not the first time that officials
have been caught out lying in public, nor is it likely to be the last.
What we can be fairly certain about regarding intelligence information
is that whatever is disclosed will be the strict minimum and likely to
be slanted to reflect the current administration's policies.
It
appears that the current US military, led by General Keith Alexander as
head of the NSA and Cyber Command, want to do more than passive
eavesdropping. According to Mr Snowden, these agencies are penetrating
and damaging foreign networks, both for espionage purposes and to ready
them for cyber attack, if required. Apparently, the US (and possibly
governments of other countries) has already created custom-designed
Internet weapons, pre-targeted and ready to be "fired" against some
piece of another country's electronic infrastructure on a moment's
notice. These include the Flame super-virus, which was uncovered last
year (to spy on PDF files) and – allegedly – Stuxnet, which was deployed
in Iran to destroy centrifuges (see
http://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet for
details). This led to considerable additional collateral damage in Iran.
A similar malware called Gauss targeted Lebanese banks, including Bank
of Beirut, Byblos Bank and Fransabank, according to Kaspersky Lab, a
Moscow-based security firm. There is still some speculation as to what
Gauss’s purpose was. What is certain is that other people will take
these examples and copy them.
The sophistication and complexity
of these forms of malware is frighteningly impressive and opinion is
united in pointing to state sponsorship. The message from Mr Snowden is
that these illicit practices are set to continue, unless they can be
held in check.
Unfortunately the victims of these attacks will
not just be individuals or selected targets, but also proprietary
software suppliers and, ironically, American hardware and software
suppliers perhaps most of all. The revelations make clear that all the
hard work to stabilise the various operating platforms and the software
application stacks built on top of them by most businesses over the past
25 years or so are now completely compromised, as are most of the
network devices in use.
Can existing core banking systems really be secure?The
proprietary nature of most of the current software stack means that
there is no access to, nor oversight of the underlying source code, nor
to the compiler tools used to create the final binary programs that are
installed, where all sorts of malware can be intentionally hidden. There
are just not enough software experts to comb through all the coding in
the software being used today, to check for hidden malware in a
reasonable period of time.
The biggest core banking software
providers, such as Temenos, Avaloq and Olympic are based in Switzerland,
regarded by many as possibly the safest jurisdiction world-wide in
terms of personal privacy. However, none of these firms have anywhere
close to the tens of thousands of people and $billions in government
funding available to General Alexander at the NSA and US Cyber Command.
The headcount at Cyber Command alone is set to increase five-fold,
following Pentagon approval in January this year, according to The
Washington Post, a US newspaper.
Until now in Switzerland, most
banks have been working on their core banking systems individually, or –
rarely – in small groups, as with some Cantonal banks. Typically, the
hope has been that a bank will have a working application after
installation of a commercial package, with some period of parallel
testing and tweaking of parameters as required. Getting the application
into operation within a given deadline has almost always taken
precedence over any other issues. This means there is a lot of
bug-filled, inefficient code sitting in banks’ server rooms. Much of the
code in the last decade has been outsourced to various low wage
economies, which have cultures less inclined to balk at bribery (China,
India, Russia, Eastern Europe). This will almost certainly catch up with
the industry and bite bankers in the tail; we just do not know when, or
where.
Banks have relied upon vendor staff to create and
maintain the packages. The development costs of the solution were shared
amongst the buyers, who hoped to pay less than the total cost to write
and maintain specific subject applications in-house.
Naturally,
vendors try to address the broadest possible requirements.
Unfortunately, not only does this accentuate the homogenisation of the
industry – a competitive nightmare, but it also means that individual
requirements still require custom modifications, though this often
negates the labour displacement and cost savings.
The packages
are most often sold without the source code, or developer documentation,
so the customer bank has no real way to audit the software package in
any depth, or to fix any defects, without going back to the vendor. The
buyers are at the mercy of the vendor, putting them at risk should the
vendor decide to discontinue the use of a particular package, or, worse
still, go out of business.
Buyers also have to struggle with
incompatibility as in-house applications are mixed with different vendor
packages that may not be fully compatible. Several products may have
redundant functionality, or not handle certain functions at all as there
is no clear line of demarcation between all of them.
The
business environment is changing faster than the programs that seek to
model it, meaning that the programs are a perpetual drag on corporate
performance. Core banking systems often take years to modify, or change.
Many of these projects have ended the careers of some otherwise
competent IT professionals.
The tendency to outsource has added
additional layers to the development process, creating additional
expense and delays. Worst of all, it has created inevitable conflicts of
interest.
The above security implications mean that, if there
are no major radical changes in the software stack being used, then
sooner rather than later, someone else could be eating bankers’ lunches.
The current proprietary model is open to abuse by corrupted employees,
competitors and government agencies, even more so when the applications
are outsourced.
What the banking industry needs is software where
the users and their representatives, can review, modify and share
source code in the best interests of transparency, security and
maintaining customer goodwill built on a free (as in freedom) software
platform.
New devices such as mobile phones and tablets in
various formats are also giving a strong impetus to refresh the approach
to core banking applications. Many core banking systems have severe
problems when it comes to scalability and integration with other
software systems. Open standards and free software have a lot to offer
to help build a more robust and appropriate solution for the future.
What is free software?Free
software, as defined by the Free Software Foundation (
http://www.fsf.org/ ), is not about price; it is about users' freedom to
run software, to study and change a program in source code form, to
redistribute exact copies, to distribute modified versions. Free
software also implies free documentation. The freedom to modify is also
crucial for documenting free software. When people exercise their right
to modify the software, and add or change its features, if they are
conscientious they will also change the software manual, in order to
provide accurate and usable documentation for the program they have
modified.
Free software means the users (banks, in this case)
control the program. Otherwise, the program controls the users. There
are several million developers writing software today. There is a high
likelihood that the majority of what you want to write has already been
written by someone else. Black Duck Software, a Burlington,
Massachusetts, US-based provider of consulting and software for enabling
enterprise adoption of open source software (OSS), estimates there are
some 600,000 free or open source software projects in existence, with
some 20 billion lines of code available. This represents some 10 million
man-years of work
http://devsbuild.it/files/PRE_andevcon_innovate-more-code-less.pdf. Free
software allows organisations to save time and investment through the
re-use of code.
Where is free software being used?Free
software has been at the heart of a lot of operating systems, such as
the GNU/Linux kernel, which has been in use at the London Stock Exchange
since February 2011. After its installation, trading times went from an
average of three to four milliseconds under Microsoft and Accenture's
supplied TradElect to 126 microseconds (i.e. around 30 times faster)
using Millennium IT’s Turquoise. Other stock exchanges that use
GNU/Linux include Deutsche Börse, the Tokyo Stock Exchange, NASDAQ,
India's National Exchange and the New York Stock Exchange.
Most
readers are likely to have seen free software being used in an
opportunistic fashion, but what I will be proposing in this article is a
more systematic use, for more mission critical applications. Up to now,
the banking industry has been more concerned with time to market, lower
costs and quality, but the industry is now at a technological
crossroads and is facing a major shake up. The perceived threats are
potentially so great, that the private banking industry may have to set
out a new software policy that is capable of meeting the challenges of
the future.
Why free software for core banking?Core
banking systems have cost many millions of dollars to develop and
implement. They are also typically the longest lived software
applications in a bank. There is great reluctance to change these
systems for many well-founded reasons.
The ethics of banking and
the financial services industry more generally have often been
challenged, but the revelations since 2007 have given rise to more
scrutiny of professional practices than ever before. Arguably, we have
seen the disadvantages of historic (and often still current) business
practices being thrown into sharp relief. Proprietary software impedes
most people from looking at the source code, whilst users are unable to
contribute to make it faster and more secure, or to improve its
development. The financial services industry has been one of the largest
software consumers after government for the past forty years, but has
traded off essential freedoms for very little in return. IT purchasing
agents have rarely spoken about freedom, ethical issues, or
responsibilities. It is probable that most leaders of financial services
businesses have preferred to ignore these issues up to now, but recent
observations are bringing the industry to a pivotal inflection point,
not least because corporate reputations and the businesses behind them
are at risk.
Why a Free IT Foundation?Finding
competent people to produce the core banking application stack is still
a concern. There are not that many firms that can properly pull this
off. The fastest way seems to be a takeover by a consortium of banks
through a not-for-profit foundation to buy out one or more of their
banking software suppliers, change the software licenses to a free
source code license or re-implement software under a free license. A
foundation aligns the banks interests to leverage their power and regain
competitiveness against those that have received unfair advantages.
Contributors to a free software project are able to capitalize their
investment and treat it as an asset instead of expense all their
expenditures (
http://www.free-it-foundation.org).
Perhaps it is time to close some old windows and open some new doors.
Gerold Rupprecht is an independent IT specialist, based in Geneva.
After Edward Snowden…are core banking systems secure?by Gerold Rupprecht - geroldr(at)bluewin.ch - is licensed under a
Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
All reproductions shall include the words "This article originally appeared on
www.thewealthnet.com".
Commercial copyright enquiries should be made to janderson(at)paminsight.com
