Twitter based stock manipulation rising rapidly

1. Twitter based stock manipulation rising rapidly IBM Confidential

2. Virtually all major areas of the SEC are using analytics • The office of compliance, examinations and inspections houses a ‘quantitative analytics unit’ • It is staffed with experts in areas of data science, mathematics, physics and computer science • The FBI has declined to provide details but it is in this unit that scrutiny is being given to computer based high frequency trading (HFT) Some high speed algorithms are triggered to automatically execute trades when strong positive or negative news appears. Criminals can take advantage by posing as legitimate broker/advisors and posting fake tweets to manipulate specific stocks http://www.telegraph.co.uk/finance/newsbysector/banksandfinance/9911886/FBI-joins-forces-with-SEC-on-computer-trading.html IBM Confidential

3. For more than an hour fraudulent tweets remained live on Burger King’s hacked twitter account. False tweets included claims that the company had been sold to McDonalds as well as ‘outrageous’ statements about BK’s company practices and employee behavior. Twitter ultimately shut down the account at the request of Burger King http://articles.chicagotribune.com/2013-02-19/business/ct-burger-king-twitter-hack-0219-20130218_1_tweets-mcdonalds-hack/ IBM Confidential

4. Fake tweets featuring the well known logo of Muddy Waters Research caused a majorsell off. 300,000 shares changed hands in 2 minutes (while average daily vol is only about 200,000) Algorithms designed to react on neg. or pos. news may have automatically initiated selling before humans took corrective action http://www.huffingtonpost.com/2013/02/01/twitter-stock-market-hoax_n_2601753.html IBM Confidential

5. “$SRPT FDA steps in as its 48 weeks results on Eteplirsen results are tainted and have been doctored they believe Trial papers seized by FDA.” The above fake tweet caused Sarepta to drop 9.9% with 700,000 shares changing hands in one minute…even though the phony Citron account had only 6 followers http://moneymorning.com/2013/03/11/how-social-media-stock-scams-could-put-your-money-at-risk/// http://www.foxbusiness.com/technology/2013/02/20/sec-on-guard-as-securities-swindlers-take-to-twitter// IBM Confidential

6. SEC Detailed Overview of Anti-manipulation Flow Overarching Analytics by Division Key actors Crowdsourcing? analysts investigators Trading and Markets Compliance Enforcement Collaboration with other agencies Office of Analytics and Research Office of Market Intelligence Quantitative Analytics Unit Systems/Tools Refer to Investigtate via Resolve with Analyze for Centralized database July 2011 SEC large trader rule requires more info for tracing Quick cancel HFT algos MIDAS (market information data analytics system) Enforcement division Third party reviews/audits Key word searches Mis-matched trade volumes Fines Office of Compliance, Inspection & Examination Surprise exams CAT real-time (consolidated audit trail) monitoring system The Division of Enforcement investigates possible violations of securities laws, recommends Commission action when appropriate, either in a federal court or before an administrative law judge, and negotiates settlements, recommends new rules Settlements Anomalous trading patterns Special agents License loss or suspension Deeper analysis Sell-side/buy- side info sharing systems Specialized analysts Indictment and trial Origin/ID trace Computer analysis of complaints, tips, social media etc FBI, DOJ, DHS or other agencies False news via social media Multiple agency collaboration Conviction

7. SEC Pursuit of Stock Manipulation via Twitter Overarching Analytics by Division Key actors Crowdsourcing? analysts investigators Trading and Markets Compliance Enforcement Collaboration with other agencies Office of Analytics and Research Office of Market Intelligence Quantitative Analytics Unit Systems/Tools Refer to Investigtate via Resolve with Analyze for Centralized database July 2011 SEC large trader rule requires more info for tracing Big increases in tweet volume MIDAS (market information data analytics system) Enforcement division Key word searches Uptick in advice/news for thin trade stocks Geo origin and ID trace Alerts/trade halt Office of Compliance, Inspection & Examination CAT real-time (consolidated audit trail) monitoring system The Division of Enforcement investigates possible violations of securities laws, recommends Commission action when appropriate, either in a federal court or before an administrative law judge, and negotiates settlements, recommends new rules Fines Third party cooperation Misspelling or look-alike of pro twitter names Int‘l sanction Multiple agency collaboration Specialized analysts License loss or suspension Known bad actors off-shore and domestic Computer analysis of complaints, tips, social media etc Special agents Arrest/charge FBI, DOJ, DHS or other agencies Deeper analysis Trial/conviction Hijacked accts

8. SEC Use Case: Stock Manipulation using Twitter Scope Description Actors and Systems Basic Flow of Events A sudden increase in news or advisory tweets about a specific stock (usually thinly traded) is detected A correlation is made between the increased tweet volume and an unexpected increase in trading volume for the stock Coordination with twitter (and other third parties) generates information about the suspect messaging activities and raises the alert that fraudulent market manipulation may be taking place. Collaborative analysis seeks identification of the tweet owner and the origin(s) of the messages. Trading of stock may be halted while investigation and analysis occurs Twitter may block and suspend the offending account(s) SEC coordinates with the affected company to update investors and markets with accurate information If the person(s) tweeting false news can be identified they may be questioned, arrested or charged Ultimately they may be fined or otherwise more severely penalized This use case describes how the SEC might uncover and pursue potential twitter based market manipulation. It presents options currently available (and in development) for analysts, officers and investigators. The adoption of analytics at the SEC has become more aggressive in response to the dominant role analytics now plays in the stock market. Tools such as twitter are increasingly used to manipulate trade activity. • Actors: • SEC analysts, investigators, agents, investors, auditors, other third parties • Inter-Agency analysts, investigators • Systems: • Centralized database • MIDAS (market information data analytic system) • CAT (consolidated audit trail) system • Automated analysis of tips, complaints Pre Conditions • Centralized database systems collect 400+GB of data a day creating a rich resource for advanced analytics • Streaming real-time data from all 13 exchanges • Analytic units present in every division • Significant increase in trained analysts • Embedded agents from other agencies Inputs and Outputs • Inputs • Continuous twitter feed analysis • Real-time trading data • Tips, complaints in central db • Outputs • Correlation of vol increases in thinly traded stocks on tweet news • New, suspicious twitter handles • Hijacked twitter account alerts • Correlation to known bad actors Post Conditions • Correlate unexpected trade volume fluctuations to stock-specific tweets • Coordinate with other agencies to analyze suspicious twitter activity • Seek ID and origin of suspect tweets • Coordinate with twitter to halt account • Updates markets with accurate news IBM Confidential