Stock Market Cybercrime Definition, Cases and Perspectives
Total Page:16
File Type:pdf, Size:1020Kb
STOCK MARKET CYBERCRIME DEFINITION, CASES AND PERSPECTIVES ALEXANDRE NEYRET 1/68 Summary For several years, and the subject has often been referred to in the press, cybercrime has been invading our world. The financial sector and more especially the stock market sector are no exception. Every year, new stock market “cyberattacks” (insider trading by hacking confidential information, the dissemination of false financial information influencing the share price of a listed company by creating “fake” websites or fake rumours on social media, the manipulation of financial instrument prices by hacking trading terminals, etc.) continue to appear. It was therefore crucial to try to provide an overview of stock market cybercrime in order to better understand the modi operandi and the problems of potential stock market breaches with a “cyber” component, which the Autorité des Marchés Financiers (hereinafter referred to as the “AMF”) may have to deal with. After defining stock market cybercrime and obtaining an estimate of the cost of cybercrime (in general) and of the impact of a cyberattack on a listed company’s share price, we analysed the various cases available publicly, sometimes trying to anticipate the future of cyber insider trading, cyber price manipulation and cyber dissemination of false information. Finally, a summarised mapping accompanied by an analysis of the factors contributing to stock market cybercrime demonstrates its future importance and its impact on the entire stock market distribution chain. 1 / 68 CONTENTS 1. Introduction ............................................................................................................................................. 4 1.1. Cybercrime and Financial Cybercrime ............................................................................................... 4 1.2. Stock Market Cybercrime ................................................................................................................ 5 1.3. Review of Existing Literature ........................................................................................................... 8 1.4. Scope, Plan and Exclusions .............................................................................................................. 9 2. Cost of Cybercrime ................................................................................................................................. 10 2.1. Uncertainties ............................................................................................................................... 10 2.2. Macro estimates .......................................................................................................................... 11 2.3. Impacts on listed companies ......................................................................................................... 14 2.4. Cost of financial and stock market cybercrime ................................................................................ 16 3. Cyber Insider Trading .............................................................................................................................. 17 3.1. Cases .......................................................................................................................................... 17 3.1.1. Information Provider ................................................................................................................ 18 3.1.2. Bank ....................................................................................................................................... 20 3.1.3. Law Firm ................................................................................................................................. 20 3.1.4. Stock Market Regulator ............................................................................................................ 20 3.1.5. Stock Exchange ........................................................................................................................ 22 3.2. Perspectives ................................................................................................................................ 23 3.2.1. Dark Web and Insiders ............................................................................................................. 23 3.2.2. Cyberattacks as Inside Information ............................................................................................ 24 3.2.3. Data Leaks, a Future Hotbed of Cyberattacks .............................................................................. 24 3.2.4. Sensitive Economic Indices and Indicators .................................................................................. 25 3.2.5. New Entry Points ..................................................................................................................... 25 4. Cyber Price Manipulation ........................................................................................................................ 28 4.1. Cases .......................................................................................................................................... 28 4.1.1. Intrusion into Retail Trading Accounts ........................................................................................ 28 4.1.2. Theft of Personal Data and Dissemination of False Information .................................................... 29 4.1.3. Intrusion into Professional Trading Accounts .............................................................................. 30 4.1.4. Organised and Sophisticated Cybercriminal Groups..................................................................... 31 4.2. Perspectives ................................................................................................................................ 32 4.2.1. Intrusion into Trading Accounts and Mobile Applications ............................................................. 32 4.2.2. Algorithms .............................................................................................................................. 33 5. Cyber Dissemination of False Information ................................................................................................. 34 5.1. Cases .......................................................................................................................................... 34 5.1.1. The Vinci Galaxy ...................................................................................................................... 34 5.1.2. Dissemination of False Information by Twitter ............................................................................ 40 5.1.3. Dissemination of False Information by EDGAR ............................................................................ 43 2 / 68 5.2. Perspectives ................................................................................................................................ 44 5.2.1. Very Wide Scope...................................................................................................................... 44 5.2.2. Fake Data ................................................................................................................................ 45 5.2.3. Deepfake and Artificial Intelligence ........................................................................................... 45 6. Cyberattacks on Stock Exchanges ............................................................................................................. 47 7. Stock Market Cybercrime and its Aggravating and Mitigating Factors .......................................................... 49 8. Conclusion ............................................................................................................................................. 50 3 / 68 1. Introduction In the 13th edition of its report on global risks in 2018,1 the World Economic Forum ranks the two risks of cyberattacks and massive data theft/loss among the five major risks in terms of their likelihood of occurrence, alongside environmental risks such as natural disasters, extreme weather conditions and climate change risks, and in sixth place in terms of severity after weapons of mass destruction (sic!), environmental risks and water shortage crises. 1.1. Cybercrime and Financial Cybercrime More generally, the paradigm shift over the past two decades has been to no longer consider cyber risk as one specific risk among many (somewhere between IT risk and operational risk), but rather as a much more generic risk, or even as a metarisk.2 This is because, in today’s world, everything has become digital, connected, and therefore potentially subject to IT attacks. The digital age has, on the one hand, enabled the renewed use of existing fraudulent schemes and, on the other, paved the way for the emergence of new criminal modi operandi. The term “cyber” is frequently used, in particular to describe any type of crime, whether cyberfraud or cyberterrorism. There is no commonly accepted legal definition of cybercrime. Nevertheless, the definition3 borrowed from the inter-ministerial working group for combating cybercrime is suggested here: “Cybercrime consists of all criminal offences that are either attempted or committed against or by means of an information system and communication network,4 mainly online.” The scope is therefore (intentionally) vast. The aim here is not to adopt a legal approach to cybercrime, so we will not dwell on this definition, which varies from