We're living in the age of the hacker

Hack or be hacked.

Never in the history of written communication could 140 characters have the impact that they can have now

Two weeks ago, after gaining access to the Associated Press’s main Twitter account (@AP), the Syrian Electronic Army (SEA) posted a fake tweet reporting two explosions in the White House and the injury of President Barack Obama. Within seconds, US financial markets dropped by about 1%.

Minutes later, Twitter was abuzz with refutations. Reporters at the White House tweeted that they felt no explosion, and AP reporters and the AP Politics Twitter account announced that @AP had been hacked. At his afternoon briefing, White House press secretary Jay Carney confirmed that Obama was indeed unharmed. Financial markets returned to their pre-hoax level.

The @AP Twitter hoax represents systemic risk that cannot be eliminated, for it arises from the interaction of highly integrated financial markets and increasingly democratized news delivery. Given strong incentives for malicious parties to perpetrate such hoaxes, we should expect to see an increase in incidents.

Financial markets are vulnerable to manipulation, because they are not in the business of evaluating the truth. Trading often favours first movers, so being fast but wrong can still be profitable.

Imagine that a sophisticated trading firm has invested significant resources to develop an algorithm that quickly evaluates the potential market impact of news, and then automatically sends orders to trade based on that predicted impact. When that algorithm parses a tweet from the AP containing important keywords (explosion, White House, and Obama), it will send orders to sell with the expectation that the market will drop as others – first, slower algorithms, then even slower humans – start to process the same news.

The first mover is happy to make such trades without verifying that the news is true. If it is true, the market will stay down or continue dropping, and the first mover will profit from the sales that it has made. If the story is a hoax, the market will probably return to its earlier, fairly valued level, and the first mover will break even on its sales, and possibly profit from any position purchased as a hedge when the market was down. The first mover’s algorithm worked, regardless of the story’s veracity.

The likely losers in the @AP Twitter hoax were later movers who did not react quickly to the news, but reacted instead to the market’s movement.

These late movers were also likely to have been sophisticated electronic or institutional traders; some were probably using arbitrage-based strategies that relied on the futures market for a calculation of the fair price.

The market’s vulnerability to hoax stories is thus difficult to eliminate, for it is inherent in its structure. It cannot be regulated away or fixed by technology or surveillance.

Even if markets moved more slowly, there would still be a first mover who responded before such a news story was revealed as a hoax. This dynamic is similar to that of an asset bubble, albeit faster. In a bubble, valuations are based on collectively evaluated evidence, and those who enter the market earliest often benefit. Whether evaluating an assumption about the rise of house prices or whether a news story is true, the market does not provide a definitive answer instantaneously.

If protecting against hoaxes is not the market’s purview, can news agencies or new media entities like Twitter prevent such deception? To be sure, they have suffered reputational damage from this fiasco and will likely try to improve. But their efforts will not be enough.

Twitter’s vulnerabilities were technically understood before this event, and the service was already moving toward a more sophisticated authentication model (a password paired with a one-time key from a text message or other device). Twitter will likely implement this soon. It should also consider adding an optional “two-key” system, in which an independent signoff from a separate account is required before a proposed tweet is broadcast. But, while such measures would increase the difficulty of hacking the system, no technological fix can make it impenetrable.

What about the AP’s vulnerabilities? Attackers launched a “phishing” attempt against the AP’s emails shortly before the hoax tweet was sent. Phishing attacks, in which an employee is duped into sending a password to a third party or clicking an untrusted link that installs malicious software, represent a hybrid of cultural and technological failures.

As attackers become more sophisticated, they send better-crafted emails, sometimes impersonating trusted sources that lure unwary users. Crafting a culture of security is difficult and often at odds with the dynamic and decentralised work environment of a fast-moving newsroom.

This story can be read in full at economia

Chris Clearfield is a principal at System Logic, an independent research and consulting firm that focuses on issues of risk and complexity. András Tilcsik is an assistant professor of strategic management at the Rotman School of Management at the University of Toronto.

Photograph: Getty Images

This is a news story from economia.

Photo: Getty
Show Hide image

“If not evolution then revolution”: temperature rises in Catalonia as independence vote looms

Clashes between Barcelona and Madrid over the disputed referendum lead to protests and arrests.

Summer may finish today according to astronomers, but the heat in Barcelona has been steadily rising over the past few weeks. Things reached boiling point yesterday when the Spanish police arrested 14 Catalan officials responsible for organising a referendum on independence for the region. They also seized about 9.8 million ballots intended for this vote, which the Catalan government wants to hold on 1 October.

The Spanish central government, the conservative People’s Party (PP), is completely opposed to the referendum and has so far refused even to discuss it with the Catalan administration. This prompted the pro-independence Catalan parties in power to start planning it unilaterally.

On 6 September, the Catalan parliament passed the Self-Determination Referendum Act, which established how the vote will be organised and held. The question would be: “Do you want Catalonia to become an independent state with the form of a republic?” And since the electoral register can only be accessed by the Spanish authorities, whoever is allowed to vote in the Catalan regional elections can have their say.

Legal experts are divided over whether this kind of independence referendum is allowed by the Spanish constitution, which was approved in 1978. This was just three years after the death of fascist dictator Francisco Franco, and one year after the first democratic elections since the 1936-39 Spanish Civil War.

According to the constitution, sovereignty resides with the Spanish people. Opponents of Catalan independence claim it is therefore up to the whole of Spain to decide such a matter – and that in any case, it would have to be approved by the Spanish government.

But those in favour of the Catalan process argue that, given the complete lack of political will in Madrid regarding the referendum, the unilateral way is legitimate even if it may be declared illegal according to Spanish law.

As expected, two weeks ago the constitutional court suspended the Catalan Self-Determination Referendum Act, and yesterday’s police operation followed. Shortly after the raid began, during a government control session in the Spanish parliament in Madrid, prime minister Mariano Rajoy said “the rule of law has worked and it’ll continue doing so”. He insisted that the government was just “doing its duty”.

In this charged atmosphere, while Rajoy was still speaking, the MPs of the Catalan parties supporting the referendum walked out of the room, while those of the ruling PP chanted: “Leave here your salaries!”

Later in Barcelona, the Catalan regional prime minister, Carles Puigdemont, said Spain had “de facto suspended self-government in Catalonia and de facto applied the state of emergency”. Surrounding him during his speech, several other high officials looked funereal.

Applying further heat to the situation, the head of the Spanish tax agency signed an order on Tuesday that gave control of the Catalan public finances to the Spanish state. From then on, and at least until the end of the year, the Catalan administration isn’t allowed to allocate any money that hasn’t been sanctioned by Madrid.

However, the Spanish central government could still go even further and, using Article 155 of the constitution, suspend self-government in Catalonia – not de facto but officially. This extreme measure, never used in modern Spain, would in theory make possible what Catalans often joke about: tanks from the Spanish army would drive down the avenues of Barcelona.

Catalonia is the richest Spanish region, last year contributing 19 per cent of the country's GDP, while its population represents about 18 per cent of the total. It has long considered itself historically and culturally different from the rest of Spain, and yet just a decade ago an independence referendum would have been inconceivable.

In 2006, just 15 per cent of Catalans wanted “an independent state”. But that year the ruling PP referred the Catalan statute to the constitutional court, which declared part of it illegal. Then, after the PP won the general elections in 2011, the Spanish government started refusing to engage with Catalonia on the issue. 

Support for Catalonia becoming an independent state remains at around 41 per cent in favour and just under 50 per cent against. However, when Catalans were asked if they would vote in a referendum not sanctioned by Madrid, 67.5 per cent said yes, and of those, 62.4 per cent would vote “Yes”.

As of today ballot boxes are still being kept in a secret location, and Puigdemont and other Catalan officials insist the referendum will be held one way or another. In the past, the Catalan PM has said that if “Yes” wins, Catalonia will declare its independence within 48 hours.

For now the atmosphere is tense. On Tuesday, thousands of people took to the streets of Barcelona to protest against the police operation, in front of several offices of the regional government that were being searched.

The biggest demonstration was next to the Catalan finance ministry, which was being searched by the Guardia Civil, the Spanish paramilitary police. Many protesters were carrying the estelada, the unofficial flag of the independence movement – some worn it as a cape, others waved it in the air.

“We are protesting against this unjust situation”, said 47-year-old sales rep Ferran Batalla. “[The referendum] is not an aggression, it’s an option to have justice, an option to ask the people what they think."

The protesters chanted in Catalan, “We will vote!”, and in Spanish, “We want to vote!” Some were distributing flyers that read in Catalan, “We vote to be free”, and graffiti on a telephone booth said in Catalan, “Voting is not a crime.”

In English a giant banner on top of the building that hosts the Catalan finance ministry read: “Welcome to the Catalan Republic”. At one point, police coming out of the building were met with deafening whistles before the crowd started chanting in Catalan: “Out with the occupying forces!”

“I don’t want to fight anybody in Spain, but we’ve reached a point in which we can’t understand each other any more”, said Batalla, who complained about the fact that the central government has always sternly refused to talk about planning a referendum. “When the state doesn’t want to negotiate, and doesn’t want you to leave, and doesn’t want to hear from you, and mistreats you… They think we are stupid, and we are fed up and this is over, because they are making us feel as if we are the bad ones."

In nearby Plaça de Catalunya just a month ago, barely a flag could be seen among the huge vigil following the terror attack on Barcelona. And if that proved to be a show of social and political unity between Madrid and Barcelona, today the Spanish government on the one side, and the Catalan authorities and many of their people on the other, couldn’t be more polarised.

Many Catalans mention the Scottish independence referendum in 2014, and the agreement with Westminster that preceded it, as an example of how things could and should happen. But the two situations are actually very different.

Catalonia makes up a far larger chunk of Spain's population and economic output than Scotland does of the UK. Meanwhile, Spain has a constitution that the government considers untouchable, while there is nothing similar in the British legal framework.

Late Tuesday, Rajoy made an official statement urging the Catalan government to get back to  law and to democracy, and stop at last this “escalation of extremism”.

"This referendum can’t be held, it has never been legal nor legitimate,” he said, before adding: “And every illegal act and every infringement will get its response, which will be determined, proportional and rigorous”.

The PM’s intervention was followed by a huge cacerolada in Barcelona and many other Catalan cities – meaning people started banging pans in their windows in protest. In the streets, demonstrations went on through the night as people tried to prevent the Guardia Civil from leaving the Catalan finance ministry. The protest was mostly peaceful, but police cars parked outside were destroyed while people chanted a rhyme in Spanish: “¡Esta noche os vais sin coche!”, or “Tonight you will leave without a car!”

Finally, at around 4am the first Guardia Civil agents started leaving the building. There were moments of tension between the protesters and the Mossos d’Esquadra, the Catalan regional police, who opened the way for the Guardia Civil.

Wednesday began calmer, as both sides considered their next steps. The Spanish government remains focused on preventing the vote from happening, but has said it will be open to dialogue afterwards. “On 2 (October) we will talk and this new dynamic will take us to look for solutions because the coexistence of all Spaniards must continue in Spain... We’ll have to sit together and talk, and that we will do”, Íñigo Méndez de Vigo, the spokesperson for the government, told Spanish Radio. 

By the afternoon, there hadn’t been word of response from the Catalan authorities, but having invested so much in the referendum and seeing the atmosphere in the streets, it’s not clear how they could backtrack.

In a bar in the Eixample area of Barcelona, right outside the city centre, people discuss the situation over their mid-morning coffee. “What happened yesterday was shocking, independently of whether one supports independence or not,” says 37-year-old Italian IT consultant Paolo Mosca, who has lived Barcelona since 2013.

“I understand that within the Spanish legal frame the referendum isn’t legal, I know this, but within the Catalan legal frame it is legal because it was approved in the Catalan parliament”, says Sergi Pedraza, a developer and who was born in Catalonia as the son of Andalusian parents.

“The only possible solution, because the situation has become unsustainable, is a referendum, but one well planned and agreed with the state”, says Álex Castaño, 28, also a developer, originally from Seville and who has lived in Barcelona since 2015.

All three would be eligible to vote and Sergi says he’d vote “Yes” while Álex says he wouldn’t vote. Paolo says he’d vote “Yes” because he understands and supports the will of those who want independence. But he and Álex say they’d probably leave if Catalonia becomes independent, because of the uncertainty of what may happen to today’s cosmopolitan Barcelona.

By noon the street demonstrations had resumed, this time in front of the Catalan High Court, where hundreds of people, many of them again carrying and wearing esteladas, were protesting against yesterday’s arrests. Loud Catalan music could be heard.

“The government in Madrid is insulting the intelligence of the Catalan people,” says retired businessman Enric T Coromina, who adds that he studied law and is “politically from the right”. He is wearing a barretina, a Catalan traditional red wool hat, and a T-shirt saying in English: “Make no mistake, I’m Catalan, not Spanish”. He’s sitting on a folding chair; has brought food, water and a blanket, and says he’s ready to spend the night here. He’s sure the vote will happen – he will back “Yes”– and will be legitimate even if not legal under Spanish law.

"If evolution is not possible from within the system, then there’s only one other way left and that’s revolution, civil disobedience,” he concludes, as more and more people join the protest.