This is also a good way to finance very expensive investigative journalism. Just short the companies' you've found dirt on.
Any idea why these models aren't huge already?
How many fewer iPhones would Apple sell if someone found a way to "jailbreak" the SEP? The difference would be a rounding error.
How many fewer Jeeps will get sold if a new remote OTA car-crasher is discovered? What if Fiat Chrysler needs to do a product recall? Guess what: they already have to do those, all the time. Software vulnerabilities, however, can usually themselves be fixed OTA.
Companies deployed hundreds of thousands of RF and GSM-connected smart meters. Almost all of them had massive OTA vulnerabilities. How likely were any of them to mess with smart meter deployment? Pretty much not at all.
What we see with St. Jude is two cases in which vulnerability discoveries seemingly can have a material impact:
* In medical devices, where the markets are already tuned into and ready to vigorously punish product recalls.
* In M&A situations in regulated industries --- but then, that case is situational: you have to time your disclosure with an acquisition, and the flaw(s) you've found have to be so serious that they might delay the acquisition.
I'm generally kind of skeptical that hack-and-short is going to be all that lucrative.
Disclosing vulns, though, I,agree not a stock shorting business.
This year, John Colville, Portfolio Manager, disclosed that he was successfully employing options on up to 66% on the equity portion of the City of Sacramento’s pension fund. We also learned that Tim Walsh, former Investment Director with New Jersey’s public pension system had similar success employing covered call options. Most recently we learned that CalSTRS intends to allocate to one or more managers a total of $150 million across both low volatility equity and covered call strategies. Upon evaluation of the performance of this initial allocation, CalSTRS may expand the program in terms of number of managers or capital invested."
Pension funds most absolutely do not speculate in options near expiry.
It doesn't matter, for stock trading purposes, whether you're making a permanent change or a temporary one. What matters is that you can predict the effect.
If the markets are essentially a random function, and any given stock a random walk, and the influence you wield is marginal, then you're taking a dangerous bet when you spend money to buy puts. Even if you can predictably harm the price of a stock ceteris paribus, you could easily lose money if your timing sucks and you try to employ your scheme when some macro event (or just a company announcement, or any other instants in the random walk of a stock) sends the stock more-than-marginally upwards.
I am not here to question whether Justine Bone can pull this particular scheme off. She picked a perfect target: a product in the medical industry, which is heavily regulated and whose vendors are punished harshly for product recalls, which was in the process of closing an acquisition by another medical industry giant.
My point is that Bone's win here is highly situational. That is great for Justine! I have nothing bad to say about her evil scheme. I'm just saying it's unlikely to be the future of vuln research.
There was a recent hack and short incident in the crypto currency world though where an unknown individual shorted a large amount of ETH right before revealing a major flaw in the design of the DAO that allowed them to steal all the funds. They forked ETH shortly there after to deny the stolen funds to the would be thief but they still made a killing of their short position.
On the investigative journalism front the case of Lumber Liquidators and Herbalife come to mind both of which had damaging information exposed by investors shorting the companies' stocks.
My car just had a recall consisting of a software upgrade from Fiat Chrysler.
http://www.theregister.co.uk/2016/08/17/smart_meters_delayed...
People have looked at stock price impact from breaches & vulnerability disclosure before and found only very mild connections that revert themselves quickly. The only reason it seems to be working now is concentrated media attention, which doesn't seem like a repeatable strategy when the whole medical device sector is a tire fire when it comes to security. After the first few times the stock market should stop reacting to this sort of news.
The risk is the business uses capital to acquire stock and defend against these attacks which is the right tactical thing to do.
The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
The right tactical thing to do is for the company to manipulate it's own share price, so that after news breaks that they're selling defective products their share price won't go down?
>The real danger though is hackers making secret deals with nefarious hedge funds to attack hard so the company can't defend. Can you imagine if someone made a wide scale assault against a company who's revenue was based purely on its cloud revenue?
That might be 'a' real danger, but what you're describing is already illegal and it also doesn't require a hedge fund, you can just demand money directly from the company because you're already committing a crime.
What happened in this case is that a hedge fund made a deal with a firm that did research into a company's products and found that they were defective, the disclosure and the impact of the disclosure on the share price is the best possible outcome.
Of course a company will buy its shares if it sees it irrationally going down. Especially in terms of a vuln which could impact its rep. Finally you want to discourage hackers from profiting off,of,this nonsense.
Blackmailing a company directly is near impossible. Secret deals with a hedge fund are hard to track.
Well maybe if they have a load of extra cash laying around. If they're in the midst of a big recall while trying to keep the rest of the business going, that may not be the case.
1. The market is already geared to punish recalls.
2. Recalls, in some limited cases, can be very costly (for instance: in the very few cases in which hardware must be replaced, you may directly incur nosebleed-expensive medical bills).
3. The tort liability that comes from directly hurting people.
But mitigating these points:
1. Hack-and-short is only really interesting if it can be applied repeatedly. Routinizing the kinds of recalls needed to fix vulnerabilities will probably recondition the markets away from punishing these kinds of recalls.
2. Most vulnerabilities, even the most serious ones, don't incur hardware-replacing vulnerabilities.
3. In most (but not all) cases, a human death from a software flaw in a medical device will require deliberate action from, well, a murderer. Which is to say: these kinds of torts are unlikely to be common. Not that I believe that, were a button made available to 8chan that would enable them to kill people on a whim, it wouldn't be pushed regularly! Rather: it's very unlikely such a button will be created at all.
http://www.fda.gov/MedicalDevices/Safety/ListofRecalls/ucm48...
http://www.bloomberg.com/news/articles/2016-08-27/icahn-mock...
But we're meant to believe that some doofus with an SQLI in some backend component is going to send GM tumbling?
I am, let's be clear, prepared to be wrong about this. But I'm happy to give clear voice to the opposing viewpoint on this hack-and-short meme.
Attributed to economist John Maynard Keynes:
Similarly, "We're all dead in the long run," does not mean that whatever long run effect being discussed will wait until after we are dead either.
I almost hope that's going to happen. Why? Because absolute security catastrophes seem to be the only way for companies to start taking security seriously enough. And I'm not just talking about your random IoT/medical device company here. I mean big companies like Google and Microsoft, too.
Google became more serious about security and encryption when it got hacked by the Chinese government. Then against after it discovered that NSA was inside its internal networks. And then upped its game for Android once Stagefright vulnerabilities came to light.
And how many millions of viruses did it take to convince Microsoft to move to at least a security model/architecture like they built in Windows Vista/7?
So perhaps others profiting big from discovering vulnerabilities in companies' products, and then shorting their stock is what's needed for these companies to significantly increase their security across the board.
Is it ideal? Of course not. But if that's what it takes, then so be it. They could go nuts on the security front today, but they don't. They're waiting for the security disasters to happen first.
It sort of reminds me of CO2 emmisions - and look how brilliantly that battle is going.
This shorting is much better, actually - it impacts metrics companies actually optimize for, so it may actually affect behavior. Not only that, it allocates money to security research, creating a virtuous circle.
But it's not all roses: it's only going to work as long as there's a stock market impact; and that's eventually dependent on security risks actually affecting the choices buyers make. That is uncertain. Most successful software has almost no competitors; software (well, and IP law) makes it trivial to create lock-in and software is trivial to mass-produce, so underdogs have a terrible time. For example: if you can effectively choose only between iOS and android, then you're likely to make that choice based on just a few of your top priorities (in CS terms: there's at most 1 bit of entropy here). Security may matter, but it's not going to have as much impact as it would in an actual proper market where there's sufficient choice for real competition to emerge.
because successful traders don't tend to advertise their winning strategies.
by the time some outfit like bloomberg is doing stories on it, rest assured it's already huge.
Software engineers are just late to the field, and now are much closer to the mechanisms that affect the market in many different industries.
There's a reason journalists have a code of (supposed) ethics. Anyone engaging in investigations for this kind of profit clearly has given up their claim to ordinary journalism (but hey, if this kind of business took off, things might be worth it).
What we need is some sort of qui tam lawsuit capability where a third party can sue device manufacturers when they have not suffered direct damages from the flawed device, and perhaps the government joins in, and then the third party receives a portion of the damages awarded. This already happens with Medicare fraud.
How often do we think that happens?
News organizations and journalists are desperate for viable funding models. Many have already violated long-standing ethics, such as by eliminating the 'firewall' between advertising and editorial, native advertising, etc.