On February 24.th it was announced that IBM would join the so-called Edison-consortium. The EDISON consortium (Electric Vehicles in a Distributed and Integrated Market using Sustainable Energy and Open Networks) consists of IBM Denmark, IBM Zurich Research Lab, Denmark's largest (National-wide) energy company DONG Energy, the regional energy company of Oestkraft, Technical University of Denmark, Siemens, Eurisco (Plant Genetic Resources) and the Danish Energy Association. Due to the environmental benefits of the electric vehicle technologies, the research will be partly funded by the Danish government. At the Technical University north of Copenhagen a large scale computing system will be established based on websphere, SOA-technology and IBM Blades. The idea is to use this to build advanced simulation and calculation models to determine the optimum time to charge electric car batteries given the surplus from electrical windmill generators. Denmark is one of the foremost countries in the World when it comes to deployment, production and development of windmills. (See Vestas homepage)
This is perfectly in line with the Danish Government’s drive towards a consensus at the upcoming climate summit in Copenhagen later this year, and it also matches perfectly with IBM’s declared strategy to support green technologies on a World Wide basis. The Green Agenda at IBM was in fact one of the most solid outcomes of a World-Wide so-called Jam, that IBm conducted with it’s 350.000 employees and more than 400 private and public business partners and customers in October 2008. The results are now being launched as recommendations, programs and new investment areas under the Smarter Planet initiative – including the Green agenda. Read about IBM Smart Planet drive
IBM currently is running more than 20 energy-related major innovative projects around the World, and the first one that was announced was the Island-state of Malta, home of the Templar Knights. Here IBM won a contract to supply the small country’s energy system with more than 250.000 intelligent meters with the intention to optimize usage of electricity, balance pricing with consumption and help consumers to time heavy use of energy.
Many more projects are bound to come up – also aiming at the consumption of energy within the IT business in itself. With a projection of energy consumption going up 10-30% pr. Year, even the current IT consumption at 2% of all the World’s energy resources will soon be very visible. The Green Datacenter is bound to be a focus item for any large organisation.
Already during his election campaign Barack Obama stressed the need to improve the protection of US against Cyber Warfare and to set up an organisation to improve protection level.
“As President, I'll make cyber security the top priority that it should be in the 21st century. I'll declare our cyber-infrastructure a strategic asset, and appoint a National Cyber Advisor who will report directly to me.
Once the election was over Obama and Biden declared at the transition website for the President electwhat would be the policy when they took office. The key areas of an increased effort against cyberwar would be (of course) to defeat terrorism Worldwide, to prevent Nuclear Terrorism, To strengthen American bio-security and to protect information networks.
At the same level the importance of improving Intelligence Capacity and at the same time protect civil liberties (a different recepei than George Bush!) plus the objective to protect American citizens from terrorist attacks and natural disasters. Protect American infrastructure and to Modernize the aging American infrastructure.
Particularly the policy to Protect Our Information Networks seems to be a new approach, as the New President is knowledgeable and capable of understanding what Cyber warfare could really do to a modern society, where most of the infrastructure - from communication networks, Media, to trains and airplanes to power stations, to sewers and drinking water - is controlled by IT systems that may be the target for cyber attacks.
As was stated also by the Frontpage in January 2009, this policy was further defined by these focus areas:
Strengthen Federal Leadership on Cyber Security:
Declare the cyber infrastructure a strategic asset and establish the position of national cyber advisor who will report directly to the president and will be responsible for coordinating federal agency efforts and development of national cyber policy.
Initiate a Safe Computing R&D Effort and Harden our Nation’s Cyber Infrastructure:
Support an initiative to develop next-generation secure computers and networking for national security applications. Work with industry and academia to develop and deploy a new generation of secure hardware and software for our critical cyber infrastructure.
Protect the IT Infrastructure That Keeps America’s Economy Safe:
Work with the private sector to establish tough new standards for cyber security and physical resilience.
Prevent Corporate Cyber-Espionage:
Work with industry to develop the systems necessary to protect our nation’s trade secrets and our research and development. Innovations in software, engineering, pharmaceuticals and other fields are being stolen online from U.S. businesses at an alarming rate.
Develop a Cyber Crime Strategy to Minimize the Opportunities for Criminal Profit:
Shut down the mechanisms used to transmit criminal profits by shutting down untraceable Internet payment schemes. Initiate a grant and training program to provide federal, state, and local law enforcement agencies the tools they need to detect and prosecute cyber crime.
Mandate Standards for Securing Personal Data and Require Companies to Disclose Personal Information Data Breaches: Partner with industry and our citizens to secure personal data stored on government and private systems. Institute a common standard for securing such data across industries and protect the rights of individuals in the information age.
Where did Obama get these ideas from? Undoubtedly from having studied what took place in Estonia in 2007, where a Russian led protest against the movement of a Russian war-memorial from the centre of Tallin to some outskirts initiated a denial of service attack that blocked the better part of the Estonian Financial Sector as well as most of the central and local government web sites for weeks.This in turn led to NATO’s profound interest in extending the defence lines of the alliance to include cyber war, so according to Computerworld, May 2008, NATO is launching a centre to detect, prevent and protect member states against cyber attacks.
But President Obama’s very first task was to launch an in-depth analysis of the security threats against US, due in 2 months from now, according to The Register.:
“This 60-day interagency review will develop a strategic framework to ensure that U.S. Government cybersecurity initiatives are appropriately integrated, resourced and coordinated with Congress and the private sector.”
The importance of the coordination with the private sector is that the threat is not only being seen as directed towards the public net services, and the analysis will be a 360 degrees review. Also it is clearly stated that privacy laws and regulations and respect for personal integrity has to maintained in parallel with an increased level of security against cyber attacks.
Also the German Bundeswehr is building up capacities and a national center consisting of 76 highly skilled specialists to oversee, predict and prevent cyberwarfare. The article in Der Spiegel February 7, 2009, states that the reason for this is an increased number of cyber attacks against German ministries and public websites.
Other very recent examples of cyber warfare was the cyberattack on Israel as a result of the attack on Gaza, and even in the former Russian Republic of Kyrgystan the Government felt the anger of the hackers (presumably either from inside Russia or – worst case – maybe endorsed by Russia) to try to down the feeble Kyrgystani network before consenting anything to US’ wish to have an airbase in the country.As stated by Computerworld UK:
“Since 18 January, the two biggest Internet service providers (ISPs) in Kyrgyzstan have been under a "massive, sustained distributed denial-of-service attack," said Don Jackson , the director of threat intelligence for SecureWorks. “
The attack followed almost similar pattern as a cyberattack against Georgia during the conflict with Russia in 2008. Seems the hackers are getting their act together based on a lot of practice by now!
The Danish Super-blogger Dorte Toft noticed that as 8000 Danish net bank users were locked out of their net bank because they had been affected by the so-called ‘Donadup’ worm this clearly illustrated the vulnerability of the Danish IT Infrastructure. As the work had a clearly identifiable Russian origin, we may be looking into the same family of super hackers as the other recent cases.
In a later blog dated February 8 2009, Dorte Toft notes that Denmark clearly lacks a central organisation to supervise and protect us against massive cyber attacks, and that the way the Financial sector handled the case of 8000 infected PC’s is a clear sign of misunderstood restrictive communication to the general public.
In fact this is not the first time the attention has been brought to the need for a more coordinated defence against cyber attacks in Denmark. In May 2004 the Danish Technology Council published a report on a project called ‘How vulnerable is the Danish IT Infrastructure?’ . This report concluded that the threat is real, it is increasing and it has to be met by a ‘total defence’ view led by a coordinating organisation. A number of other practical suggestions were proposed, but only a few of them seem to have been followed. So it seems that Dorte Toft is absolutely right in her conclusion and it would be about time that the warnings from 2004 are being heard – and followed. It is not enough to rely on a NATO centre, we have to have a coordinating, practical body with sufficient level of expertise and with legal power to coordinate sector organisations like Finansrådet – The Danish Bankers’ Association - but also other sector organisations like the Telesector, the Energy sector, the transportations sector and of course Danish Industry including the IT industry.
It is not a moment too early that the Government and the heavy ministries – Ministry of Defence, Ministry of Justice – together with the Ministry of Technology - start to do something. They have got a clear advice not only from Teknologirådet /The Technology Council but also from the IT industry ITEK and the Danish Industry Security Committee. And from Dorte Toft as well.
During 2009 the New Danish Digital Signature will be rolled out; already before availability, critics have stated that it seems to be complicated to install and to use. Usage requires a one-time code to be entered, and there is no single recommended or secure external media to ensure mobility.
However, the major advantage of the new Digital Signature is that it is a cross-sector solution supported by the public and by the financial sector. But, as I have stated earlier, it’s usability in my eyes is limited because it does not give the citizens any new kind of Identity Card.
The requirements for an electronic identity is increasing, not least because of the explosion of the take-up of social networks – both by NGO’s, companies, media,private citizens and now also more and more by the public sector. These networks holds some part of the individual’s profile and rightfully need to be protected – but maybe not using the full power of a qualified digital certificate.
In some countries the public sector have ambitions to set up a ‘one stop shopping’ portal for access to all public services; in US the primary purpose is to ensure and control who is allowed inside, in a number of European countries the aim is to increase use of on line services with a minimum of user inconvenience by setting up a centrally managed authorization and control system – single sign on.
But why should everybody need to use a strong certification for accessing everyday type of information or standard services, where only the citizenship, maybe age, sometimes postal number, is of importance?
It was interesting to note that the German law on digital identities offered a user-centric way of controlling how much PII (Personally Identifiable Information), each citizen would like to reveal.
So my suggestion is that a web 2.0 enabled World will require user centric identity management, not a centralized monolithic control mechanism. Yes, access to personalized health information requires a real strong identification. But does participation in a chat room concerning the local city planning aspects? Hardly.
IBM’s Zurich Laboratory has been one of the driving forces in a consortium - consisting of 20 scientific institutions as well as private companies - called PRIME - PRIME - Privacy and Identity Management for Europe :
“PRIME aimed to develop a working prototype of a privacy-enhancing Identity Management System. To foster market adoption, novel solutions for managing identities had been demonstrated in challenging real-world scenarios, e.g., from Internet Communication, Airline Passenger Processes, Location-Based Services and Collaborative e-Learning.”
“The success of PRIME is evidenced by the number of offspring projects, including “PrimeLife”,PICOS and PrivacyOS—bringing privacy high up on the European research agenda. “PrimeLife”, also coordinated by IBM’s Zurich Research Lab, is the direct successor project of PRIME and aims at empowering users to manage and control their personal data and privacy throughout their entire lifetimes, whenever they participate in Web 2.0 technologies, such as social networks or virtual communities, which raise substantial new privacy challenges.”
IBM Zurich’s major contribution to the project is the solution called IDEMIX, somewhat misleading mentioned as ‘anonymous authentication’. Themain author of IdeMIX, Jan Camenisch from IBMResearchCenter, in his presentation describes that the idea is to have the user control how much PII to reveal by having one secret, private key but multiple public keys signifying different levels of PII. In fact, the term Pseudonymity would have been more appropriate.
User-centric identity systems (sometimes referred to as Identity 2.0) are an attempt to put the
control back into the user's hands. In this way a user gains consent as to what information
about them is disclosed to which sites and for what purpose. One of the other benefits of user-centric identity systems is that they can be loosely coupled relationships. The relying party does not necessarily need to have a pre-existing trust relationship with the identity provider (be it a managed identity provider or self-issued). This arrangement allows for a non-password-based account bootstrapping process, which is easier for both users and
relying parties.
Currently there are 3 standards available that supports this type of User Centric Identity Management (also supported by IBM’s Tivoli Federated Identity Manager):
If you look carefully at these 3 solutions, it seems that the Eclipse-based solution holds the best potential for an a multi-level open, future oriented standard. OpenID is a practical ID-solution, but does not offer the granularity and level of ID revealed that is characteristic for IdeMIX and the Eclipse solution.
One of the reasons for stating this is also that the eclipse solution has been used as a foundation to develop a new generation XML-based policy management solutions – XACML - eXtensiveAccess Control Markup Languagewhich is ideal for developing and implementing privacy and security policies in existing applications without change.
This is typically a problem when you have large, complex database transaction systems, like health service solutions. Patients’ data are protected (HIPAA or similar compliance regulations) and must not be revealed unless consent has been obtained. This can then be combined with a multi-level user centric identity management model, so that consent from a patient (with highest level of identification proof) stating that ‘any doctor’ could be allowed access, or even make access granular, so that basic health information could be revealed to any person employed by the health sector.
This example illustrate that the whole idea of User Centric ID management first and foremost is to help the citizen obtain control of her own data – and make this control a practical and easy tool.
In Europethe Commission has begun preparation to renew and re-design the Data Privacy and Protection Directive from 94, which many now considers outdated. It is highly likely that a revision will further strengthen the need for user centricity, ownership and control over personal data.
A couple of weeks ago one of our friends from Liseleje, Axel Hvidtfeldt, occurred on TV where he proposed the creation of a Bronze Age center in Northern Zealand. The background for this idea was the occurrence of a huge stone filled with Bronze Age drawing, Petroglyphs, close to Liseleje at Hyllingebjerg.
The Hyllingebjerg Stone is an 8.5 tons granite monolith, which was left atop Hyllingebjerg, by the receding icecap in Northern Europe about 10 000 years ago. Hyllingebjerg is a 28 meter high earth cliff at the coast of Northern Zealand in Denmark. The stone was in the Bronze Age, about 3000 years ago, decorated with rock carvings including ships, sun wheels and about 300 bowl shaped carvings.
The stone and its rock carvings were first discovered in May 1983 when it was lying on the beach at Hyllingebjerg, where it had tumbled from the cliff 28 meters above. The stone had lodged at the waters edge half buried in sand after storms had eroded the cliff. The DanishNationalMuseum was alerted, but was not at the time, interested in a conservation project because of lack of funds.
Following a period with some interest from one of the National Museum’s specialists, the stone was moved to a local museum in Frederiksværk, Gjethuset, but in August 1999an attempt was made to have the stone exhibited in a diamond shaped glass cage within a fully controlled atmosphere (Relative Humidity and Temperature) at the top of the Hyllingebjerg cliff, which 3000 years ago was a cultural and religious place. The project was not realised due to lack of funds, so the stone remained hidden away from the public in a dark corner of the “Gjethuset”.
At that time the rock carvings were not drawn up and barely visible. Sometimes during 2001thestone was then transported to Stone Conservator Leif Vognsen´s facility at Gram in Jutland, Denmark, a journey of 317 kilometres. There is no record of this transport. The stone spent the next 4 years at Leif Vognsen´s shop. Here the stone was cleaned, but it is not known precisely which methods and which agents were used in this process and this needs to be further investigated.
The hundreds of rock carvings on The Hyllingebjerg Stone were in August 2004identified by Scandinavia’s foremost authorities on rock carvings, Gerhardt Milstreu, and the DanishNationalMuseum’s Flemming Kaul on a grant from the EU. The carvings were touched up with white paint and the carvings were photographed 2-Dimensionally. The beautiful 3000 years old artwork was now after 11 years again clearly visible. The stone was to remain at Leif Vognsen´s conservation shop for another year.
InNovember 2004 “Hyllingebjergstenens Venner” – The Friends of the Hyllingebjerg Stone -had received a grant, which made it possible to have the rock carvings photographed using a new 3-Dimensional photographic technique. We also had a model of the Egtved Girl from the same Bronze Age pose next to stone so as to give an impression of the size of the stone. The result was posted on the Internet and can be viewed at www.frvhistorie.dk/Hyllingebjergstenen. Here the artwork can be admired from all sides through manipulating the computer mouse.
The again on the 19th of November 2005 then stone was transported to Hilleroed, where it was put in a cold store, as it was explained by the National Museum, to protect the stone from decaying if left out to the rain and sun. This was a little bit stiff to the local historic committee and to our friend Axel Hvitfeldt, so right now they have increased their lobby, not only to get – at least a copy – if not the stone itself back, but to create a Danish bronze Age Center in the area of the find.
Now the Bronze Age – which in Denmark and the Nordic countries is dated from 1800 BC to around 500 BC, was a period with a nice warm climate, in fact you could grow grapes in Denmark. The coast line was much higher – maybe what we will see in another hundred years as a result of the melting of the inland ice. The period was named after the most precious metal used for weaponry and ornaments, most particular some very characteristic women belt ornaments.
The so-called ‘girl from Egtved’ (Pictured beside the stone )represents this glorious period and the short skirt clearly illustrates the climate.
At the North Zealand peninsula Halsnaes around Hyllingebjerg we do in fact find a lot of Bronze Age Mounds, very characteristic burial sites as well as remainders from villages and fishing places .There is little doubt that the Nordic Bronze Age produced a high level of technically well equipped ships, which are among the most typical drawings on the petroglyphs. It is believed that the carvings represent pictures of the sun and that the ship actually illustrates the transport vessel of the sun across the sky.
These ships later developed into the Vikingships, but already in the Bronzeage they were obviously used as a means of transportation across the Baltic sea and deep into Europe on the rivers following the so-called amber-route, where the Nordic people exchanged fur and amber for precious metal and occasional weapon.
It is believed that the religion contained to Gods – a male and a female – which can be seen on contemporary petroglyphs in Sweden, and that these Gods later became absorbed in the Nordic mythology as Freya and Frey – or Freja and Frøj. Freya seems to have been the goddess Nerthus as described by Tacitus.
The 'sun wagon' from Trundholm Mose depicts the Sun God.
The beautiful North Zealand area would be perfect for a living Bronze Age museum, and as the Jelling Stone – one of the Unesco Heritage points in Denmark – is also in need for coverage against weather and sun the project for the Hyllingebjerg Stone developed by the Famous Danish artist Bjørn Nørgaard could easily be replicated and re-used.
I do hope that this project will attract interest also of some of the heavy weight foundations in Denmark. It would be a beauty along with the Neolithic center in Hjerl and the Iron Age Research Center at Lejre.
As is usual around the change of year a number of specialists in all disciplines try to make predictions of what is going to happen in the year to come. And also the ‘security specialists’ have been very active. Before we turn to the actual predictions it may be worthwhile to see what really happened in 2008 in terms of cyber attacks and cyber crimes.
His analysis for what happened during 2008, described as ‘the best of the worst in 2008’ pointed to the following major observations:
New Malware Variants and new Families of Threats – millions of distinct threats that mutate as they spread.
Fake Applications – ‘Scareware’ – fake secure sw applications that install together with a Trojan horse.
Web attacks galore – Symantecs figures point to the web as the prime area for attacks
Underground Economy – hard to estimate the real size of this, the investigators claim that in a year they noticed stolen goods traded on the Internet at the value of more than 276 million $, but this is probably only a very small fraction.
Data Breaches – this of course includes company specific data as well as public stored personal information. Particularly in UK and US some really extraordinary data losses of public data have been noticed.
SPAM – Still very active and annoying, but in fact because of more advanced spam-filters down to some 60-65% of what it was at it’s height
Phishing was also a major threat in 2008 – various techniques and baits used in different economies, Obama’s election was but one example.
Browser and plug in vulnerabilities – cyber attackers are carefully studying loopholes and vulnerabilities and even if Microsoft Explorer’s total domination may be going away, there are still room for improvement also in other browsers.
Explosion of Malware Variants – according to Symantec’s analysis, there is now more malware programs being released on the internet than legitimate programs! This calls for new types of detection programs needed.
Web Threats – It is expected that web services will be the next area for introduction of threats. This points toward the need for some certification scheme for web services.
The Economic Crisis will give rise to new types of fraud promising people to get rid of their loans or offerings , or maybe web sites promising new jobs. These types of fraud typically hits the weaker and poorer.
Social Networks – phishing for username and account info. Based on the rapidly growing success of social networks also as a part of normal enterprise web sites, it is inevitable that more threats will come in this area.
SPAWAR
Other highly competent sources of knowledge of security threats include SPAWAR – The US Space and Naval Warfare Command Centre in San Diego. Among their tasks they will provide: "…revolutionary information superiority and dispersed, networked force capabilities to deliver unprecedented offensive power, defensive assurance, and operational independence to Joint Force Commanders."
- General move towards ‘information centric security’ with data as the focal point as opposed to the traditional user/application rights management focus.
“What seems certain, concludes the Sophos report, “Security threat report: 2009,” is that the variety and number of attacks will continue to escalate, compromised PCs will remain the primary source of spam, and web insecurity and SQL injections will remain the primary distribution method of malware. “
Infected web pages are cropping up three times as fast this year as compared to last, while the number of infected web pages increased from one every 14 seconds in 2007 to one every 4.5 seconds in 2008, according to Cluley.
“There's a real challenge in how businesses big and small will manage this problem and ensure that their web sites are properly secured and hardened from SQL injection attacks,” he said.
In addition, malicious emails with a greater proportion of legitimate looking attachments, or web links aiming to infect unpatched users, are likely to be sent. Data leakage and identity theft resulting in decreased customer trust and loyalty will continue to pose problems for enterprises, Cluley said.
On the bright side – security software is getting better and more proactive.
For enterprises, Cluley recommended dealing with the security risks with a tiered defense against attacks, including up-to-date anti-virus software, firewalls, security patches and policy control and user education.
John Strand not surprisingly, points to Wireless risks first:
“Wireless risks continue!
There are so many ways to attack a client system via wireless vulnerabilities, as you can see just by looking at Karma, a set of tools for assessing the security of wireless clients, and karmetasploit, a tool that acts as a wireless access point and responds to all probe requests from wireless clients.
I believe that many organizations are about five years behind the curve when grappling with Wi-Fi threat vectors”….
“ ..vendors implement new protocols and authentication schemes like TKIP, LEAP and PEAP in different ways. We need to fully research the protocols used by our vendors before implementing them in our organizations.”
But John Strand also predicts that new interest for hackers will be directed to the Operating Systems:
“While operating system attacks have not reached the effectiveness and prominence they had from 2003-2005, malicious hackers will most likely discover operating system vulnerabilities again. There has been a tremendous amount of research over the past few years in browser-based attacks like cross-site scripting (XSS), cross-site request forgery (XSRF) and clickjacking. But what if these techniques were used in conjunction with an operating system vulnerability?”
Finally John Strand points to a possible blind spot in the convergence taking place between Web servers and Browsers.
Ponemon Survey Also the Ponemon Institution conducted a study – 2008 security Mega Trends Survey – where they concluded the following predictions for 2009:
“Cybercrime and outsourcing were named the top security concerns for 2009. In addition to uncovering a changing view of how IT organizations are becoming less siloed and more collaborative, key findings from the Security Mega Trends Survey include:
Outsourcing IT is a Major Concern
Data Breaches and Cybercrime
Workforce Mobility Contributes to Data Loss
Web 2.0, P2P, Virtualization and Cloud Computing are Growing in Prevalence “
So the overall picture from all experts – with some variations – points to the same areas or issues. Or is it just that everybody is picking everybody’s brain that this seems so very identical? I will almost be willing to bet that CyberCriminals are more innovative than the sum of all the experts, and that some – until now unseen – types of threat will occur in 2009. With the growing number of computers in everything maybe a new type of crime will be focused on this ‘internet of things’ phenomenon?
The easiest thing of course is to project threats in the areas where you have some remedies and tools to cope with the known – and to sell!.
What we have to fear most is probably not what we know but those areas where we are not even aware of not knowing anything.
(Picture: Icelandic SUV's parked after the crisis - source: IMF)
According to a number of speeches from high level officers within the IMF these last few days, IMF has finally realized the magnitude of the financial crises, and at a meeting in Madrid on December 15, the managing director of the Fund, Dominique Strauss-Kahn was cited to have said that the international community would have to come up with at least 2% of the Worlds’ expected total GDP in order to combat the crisis.
A few days before this speech, his first deputy director, John Lipsky, addressed a conference in Steigenberger Hotel,Frankfurt via a Videoconference link from WashingtonD.C. He stressed the severity and depth of the crisis, loss of consumer confidence and the impact on the emerging economies. He said:
“In November, the IMF revised down its forecast for global growth, less than a month after the publication of its October World Economic Outlook. Based on current policies, the world economy is projected to grow by 2¼ percent in 2009, down from about 5 percent in 2007, before picking up in 2010. The major advanced economies are in recession, and activity is expected to contract by ¼ percent on an annual basis in 2009, marking the first annual contraction in the post-war period for this group of countries.”
The most interesting part of his pitch was the underpinning of the need for what he called a reform of the financial architecture:
“These include the design of financial regulation; the assessment of systemic risk; and creating mechanisms for more effective international action to reduce the risk of crises, and to address them when they occur.
Financial innovation and integration also have increased the speed and extent to which shocks are beingtransmitted across asset classes and countries, and have blurred boundaries, including between systemicnon-systemic institutions. Regulation and supervision, however, remain geared at individual financialadequately consider the systemic and international aspects ofdomestic institutions' actions. ...
The challenge, therefore, is to design new rules and institutions that reduce systemic risks, improve financial intermediation, and properly adjust the perimeter of regulation and supervision, but without imposing unnecessary burdens.”
What John Lipsky is pointing at is that one of the most important powers beyond the speed of of the crisis are the so-called financial derivatives combined with a lack of international assessment of the real risk of these ‘inventions’. He stated that the crisis has underscored the tension between globally active financial institutions and nationally bounded regulators and supervisors.
And his final sentence was:
“Enhanced information provision will also be important for improving the assessment of any build up of systemic risks. This will require reviewing transparency, disclosure and reporting rules. Information requirements will also need to cover a larger set of institutions, from insurance companies to hedge funds and to off-balance sheet entities.”
This very much reflects my own earlier remarks on the need for a complete restructuring and possible combination of IMF, G20 and the World Bank with equal voting rights also for the BRICcountries.
Dominique Strauss-Kahn’s speechin Madrid on December 15 had similar and maybe even more stressing points; the purpose of the meeting was to celebrate Spain’s 50th anniversary as member of IMF.Dominique Strauss-Kahn said that action is needed on three fronts to prevent the current recession turning into a global depression:
• Coordinated government intervention in financial markets to get credit flowing and support bank recapitalization
• Fiscal measures to offset the abrupt fall in private demand
• Liquidity support for emerging market countries to reduce the adverse effects of the widespread capital outflows triggered by the financial crisis.
In some of the starkest language he has used since the crisis erupted, Strauss-Kahn said governments around the world have endorsed this agenda, most recently at the November meeting of the Group of 20 (G-20) industrialized and emerging market countries in Washington. "Many have begun to implement it. But the actions taken so far are not enough. We need more," he said, according to the text of remarks as prepared for delivery.
According to the most recent IMF forecast, the major advanced economies are expected to contract by ¼ percent on an annual basis in 2009, marking the first annual contraction in the post-war period for this group of countries. But with the effects of the crisis spreading rapidly, IMF First Deputy Managing Director John Lipsky has said that the Fund is likely to revise downward its global forecast when it announces new numbers next month.
"We are facing an unprecedented decline in output, we have evidence of substantial uncertainty limiting the effectiveness of some fiscal policy measures, and we anticipate that the negative growth effects will last for some time. For all of these reasons we are calling for stimulus measures that are large and diversified, and that will last longer than one or two quarters," said Strauss-Kahn.
His main points were that a lot of fiscal measures can be effectively applied to maximize the multiplier effect of different fiscal measures. Actions could include support to housing and finance; transfers to low-income families, greater provision of unemployment benefits, improved tax benefits for low-wage earners, and expansion ofbenefits and spending on major projects—particularly those that are already planned and could be implemented quickly, as time is everything. But the IMF would not recommend reduction in corporate tax rates, dividends and capital gains taxes, or special incentives for businesses. "These are likely to be ineffective and difficult to reverse," Strauss-Kahn said. This is quite remarkable considering the pressure on Washington to help the troubled car makers in US. Let us look at the indications from IMF that the real problem behind the crisis might be the so-called derivatives.
Looking into the history of derivatives we find some real horrors – not least in the reason for why they were created in the first place. Of course neither IMF nor any of the heavy weights in the Financial Sector had warned (sufficiently) or earlier against these derivatives, except a few remarkable persons, which I will come back to.
But these days the papers and blogs are filled of stories like this one:
Jesse Essinger has a fine description of what compared to these 58 Trillions $ elephant in a room:
“The history behind the derivatives seems to be an invention by a team of JP Morgan’s top economists around 1995 at a time when Morgan’s books were under pressure; they had reached the practical maximum of guarantees to private companies, and if they extended these credit lines, they would very soon run the risk of crossing the line of solvency according to standard regulation terms.
So the idea that the team came up with was derivatives”
The idea behind the construction is that if you can sell somebody a lottery ticket that the guarantees you issue to a third party company and that other wise should have been shown on your books, now gives you the opportunity to keep your guarantees and credit lines to lenders out of the books, and in this way leverage your equity way beyond what the normal national financial rules would allow. And as you sell these lottery tickets all over the World in a global sweepstake, other financial institutions can make additional lotteries out of the original lottery making it completely impossible to estimate the real risk. The 58 Trillion Dollars is probably on the low side.
As early as in 1998 Long Term Capital Management (“LTCM”) encountered financial difficulties that required a bailout by banks, orchestrated by the Federal Bank of New York. LTCM is now forgotten and the lessons were forgotten surprisingly quickly.
Also this link contains the story of Amaranth: (Edited by Satyajit Das, the author of ‘Traders, Guns & Money’ Buy his book here:
“Amaranth was a multi-strategy hedge fund. Amaranth Advisors started life as a convertible arbitrage fund (a relatively low risk trading activity). The fund was a recent entrant into energy trading – an infinitely more volatile activity. Just before it blew up, the hedge fund had assets of $9.2 billion. Amaranth's investor base is believed to include funds of funds at major investors such as Goldman Sachs, Morgan Stanley, Credit Suisse, Bank of New York, Deutsche Bank and Man Group. Amusingly, Amaranth claimed to have “best-practice” risk management.
Risk Models – Nick Maounis after the losses surfaced, noted: “Although the size of our natural gas exposure was large, we believed, based on input from both our trading desk and the stress testing performed by our energy risk team, that the risk capital ascribed to the natural gas portfolio was sufficient”. It is questionable that the risk models used were appropriate. For example, correlation risk (one of the main risks in relative value trading) is not generally well captured in traditional risk models. A cursory review of the events shows the inherent limitations of the risk models used. Amaranth took approximately 80 trading days to make $ 2 billion through the end of April and approximately 20 trading days to lose $ 1 billion in May 2006. Amaranth also took twelve trading days to lose a reported $4.44 billion through September 18th or a daily average of close to $ 370 million. Further, when the sale of the energy book was announced on Wednesday, 20 September, the losses were approximately $6 billion and the average daily loss for September expanded to $ 420 million per trading day.”
The story of derivatives also contains other names of interest – Robert Reoch and Blythe Masters seem to be the most notorious:
Blythe MastersCalled:'Thewoman that invented the Weapon of financial Mass Destruction'
As the story goes: “In 1997, she and a team developed many of the credit derivatives that were intended to remove risk from companies' balance sheets. The idea was to separate the default risk on loans from the loans themselves. The risk would be moved into an off-balance sheet vehicle. The product was called Bistro, otherwise known as broad index secured trust offering.
In a guide to understanding the instruments she had created, Masters sung their praises: "In bypassing barriers between different classes, maturities, rating categories, debt seniority levels and so on, credit derivatives are creating enormous opportunities to exploit and profit from associated discontinuities in the pricing of credit risk."
The banks argued that by trading credit derivatives of the kind pioneered by Masters, they had spread their risk elsewhere and therefore needed lower reserves to protect against loan defaults. Regulators rolled over and the banks loaned ever more. It was a huge success and the market for credit derivatives grew rapidly.”
It is fantastic to read Blythe Masters comment on her invention: “By enhancing liquidity, credit derivatives achieve the financial equivalent of a free lunch, whereby both buyers and sellers of risk benefit from the associated efficiency gains.
“At stake is the unfathomable $56 trillion notional value of derivatives contracts between U.S. commercial banks and counterparties, measured by the Office of the Comptroller of the Currency at the end of 2002. The entire market, around the world, is estimated at over $100 trillion. But such notional amounts--the face amount of the underlying security--are rarely realized”
But also Alan Greenspan:did what he could to let the derivatives go on the run: In 1994, a bi-partisan bill was introduced in Congress to tighten the supervision of the complex and growing derivatives in the banking industry. The bill would have had the regulatory agencies establish standards for capital requirements, disclosure, accounting and examinations and audits. As expected, the banks argued that no new laws were needed. Greenspan sealed the legislation's defeat by testifying that the Fed had the powers it needed and that a taxpayer bailout caused by derivatives was remote.
Read the comments on Forbes here. (“The great Derivatives Melt down”)
As a closing conclusion on these ‘Weapons of Mass Destruction’ (More real than some other WMD) – a PDF from the originator, JP Morgan’s Guide:
“The use of credit derivatives has grown exponentially since the beginning of the decade. Transaction volumes have picked up from the occasional tens of millions of dollars to regular weekly volumes measured in hundreds of millions, if not billions, of dollars. Banks remain among the most active participants, but the end-user base is expanding rapidly to include a broad range of broker-dealers, institutional investors, money managers, hedge funds, insurers, and re-insurers, as well as corporates. Growth in participation and market volume is likely to continue at its current rapid pace, based on the unequivocal contribution credit derivatives are making to efficient risk management, rational credit pricing, and ultimately systemic liquidity. Credit derivatives can offer both the buyer and seller of risk considerable advantages over traditional alternatives and, both as an asset class and a risk management tool, represent an important innovation for global financial markets with the potential to revolutionise the way that credit risk is originated, distributed, measured, and managed.”
