© 2013 IBM Corporation1 IBM Confidential

Twitter based stock manipulation rising rapidly

© 2013 IBM Corporation2 IBM Confidential

http://www.telegraph.co.uk/finance/newsbysector/banksandfinance/9911886/FBI-joins-forces-with-SEC-on-computer-trading.html

• Virtually all major areas of the SEC are using analytics

• The office of compliance, examinations and inspections houses a ‘quantitative analytics unit’

• It is staffed with experts in areas of data science, mathematics, physics and computer science

• The FBI has declined to provide details but it is in this unit that scrutiny is being given to computer based high frequency trading (HFT)

Some high speed algorithms are triggered to automatically execute trades when strong positive or negative news appears. Criminals can take advantage by posing as legitimate broker/advisors and posting fake tweets to manipulate specific stocks

© 2013 IBM Corporation3 IBM Confidential

For more than an hour fraudulent tweets remained live on Burger King’s hacked twitter account. False tweets included claims that the company had been sold to McDonalds as well as ‘outrageous’ statements about BK’s company practices and employee behavior. Twitter ultimately shut down the account at the request of Burger King

http://articles.chicagotribune.com/2013-02-19/business/ct-burger-king-twitter-hack-0219-20130218_1_tweets-mcdonalds-hack/

© 2013 IBM Corporation4 IBM Confidential

http://www.huffingtonpost.com/2013/02/01/twitter-stock-market-hoax_n_2601753.html

Fake tweets featuring the well known logo of Muddy Waters Research caused a major sell off. 300,000 shares changed

hands in 2 minutes (while average daily vol is only about 200,000) Algorithms designed to react on neg. or pos. news may have automatically initiated selling before humans took corrective action

© 2013 IBM Corporation5 IBM Confidential

http://www.foxbusiness.com/technology/2013/02/20/sec-on-guard-as-securities-swindlers-take-to-twitter//

“$SRPT FDA steps in as its 48 weeks results on Eteplirsen results are tainted and have been doctored they believe Trial papers seized by FDA.”

The above fake tweet caused Sarepta to drop 9.9% with 700,000 shares changing hands in one minute…even though the phony Citron account had only 6 followers

http://moneymorning.com/2013/03/11/how-social-media-stock-scams-could-put-your-money-at-risk///

© 2013 IBM Corporation6

SEC Detailed Overview of Anti-manipulation Flow

Computer analysis of

complaints, tips, social media

etc

Centralized database

Trading and Markets

CAT real-time (consolidated

audit trail) monitoring

system

Office of Analytics and Research

Enforcement

Office of Market Intelligence

analysts investigators

Key actors

Systems/Tools

Overarching Analytics by Division

MIDAS (market information data analytics system)

Quick cancel HFT algos

Mis-matched trade volumes

Anomalous trading patterns

Sell-side/buy- side info sharing

systems

Enforcement division

Office of Compliance, Inspection & Examination

Third party reviews/audits

Analyze for

Quantitative Analytics Unit

Compliance

Refer to Investigtate via Resolve with

False news via social media

Surprise exams

FBI, DOJ, DHS or other

agencies

Special agents

Deeper analysisSpecialized

analysts

Multiple agency collaboration

Fines

License loss or suspension

Settlements

Indictment and trial

Conviction

Origin/ID trace

© 2013 IBM Corporation7

SEC Pursuit of Stock Manipulation via Twitter

Computer analysis of

complaints, tips, social media

etc

Centralized database

Trading and Markets

CAT real-time (consolidated

audit trail) monitoring

system

Office of Analytics and Research

Enforcement

Office of Market Intelligence

analysts investigators

Key actors

Systems/Tools

Overarching Analytics by Division

MIDAS (market information data analytics system)

Big increases in tweet volume

Uptick in advice/news for thin trade stocks

Misspelling or look-alike of pro

twitter names

Enforcement division

Office of Compliance, Inspection & Examination

Third party cooperation

Analyze for

Quantitative Analytics Unit

Compliance

Refer to Investigtate via Resolve with

Known bad actors off-shore

and domestic FBI, DOJ, DHS or other

agencies

Special agents

Deeper analysis

Specialized analysts

Multiple agency collaboration

Int‘l sanction

License loss or suspension

Arrest/charge

Trial/conviction

Geo origin and ID trace Alerts/trade

haltFines

Hijacked accts

© 2013 IBM Corporation8 IBM Confidential

SEC Use Case: Stock Manipulation using Twitter

Actors: • SEC analysts, investigators, agents,

investors, auditors, other third parties• Inter-Agency analysts, investigators Systems: • Centralized database• MIDAS (market information data analytic

system)• CAT (consolidated audit trail) system• Automated analysis of tips, complaints

Actors and Systems

Inputs• Continuous twitter feed analysis• Real-time trading data• Tips, complaints in central dbOutputs• Correlation of vol increases in

thinly traded stocks on tweet news• New, suspicious twitter handles• Hijacked twitter account alerts• Correlation to known bad actors

Inputs and Outputs

This use case describes how the SEC might uncover and pursue potential twitter based market manipulation. It presents options currently available (and in development) for analysts, officers and investigators. The adoption of analytics at the SEC has become more aggressive in response to the dominant role analytics now plays in the stock market. Tools such as twitter are increasingly used to manipulate trade activity.

Scope Description

• Centralized database systems collect 400+GB of data a day creating a rich resource for advanced analytics

• Streaming real-time data from all 13 exchanges

• Analytic units present in every division• Significant increase in trained analysts• Embedded agents from other agencies

Pre Conditions

• Correlate unexpected trade volume fluctuations to stock-specific tweets

• Coordinate with other agencies to analyze suspicious twitter activity

• Seek ID and origin of suspect tweets• Coordinate with twitter to halt account• Updates markets with accurate news

Post Conditions

1. A sudden increase in news or advisory tweets about a specific stock (usually thinly traded) is detected

2. A correlation is made between the increased tweet volume and an unexpected increase in trading volume for the stock

3. Coordination with twitter (and other third parties) generates information about the suspect messaging activities and raises the alert that fraudulent market manipulation may be taking place.

4. Collaborative analysis seeks identification of the tweet owner and the origin(s) of the messages.

5. Trading of stock may be halted while investigation and analysis occurs

6. Twitter may block and suspend the offending account(s)

7. SEC coordinates with the affected company to update investors and markets with accurate information

8. If the person(s) tweeting false news can be identified they may be questioned, arrested or charged

9. Ultimately they may be fined or otherwise more severely penalized

Basic Flow of Events