9 electronic attacker then turns off the GPS spoofing signal and the GPS timing system once again receives the real GPS signal and returns to the correct time in the server.<sup>13</sup>

**6. Insider Trading/dealing** ---Insider trading occurs when a broker or trader takes a position with respect to securities based on certain information obtained before it is made public. The Internet facilitates “insider trading” in numerous ways.  E-mail and instant messaging programs on a trader/brokers computers can be compromised fairly easily.  Trojans<sup>14</sup> and worms can be used to siphon material data from an insider’s computer and transmitted to an outside party. For example Backdoor.Tkbot, by definition an IRC<sup>15</sup> Trojan has the capability to perform  nefarious activities such as to “gather user/system information”, upload a file to the victim's system, or download a file from the victim's system. The use of wireless devices by traders increases the potential for market manipulation due to the use of unsecured WLANs, GPRS, GSM and CDMA<sup>16</sup> . Criminals from outside the “secure enclave”  of the trading floor can attack these devices and compromise them thus hijacking the markets for illicit gain. The relative physical security provided by the modern trading floor is bypassed by the wireless transmission of financial data throughout the facility and beyond.

**7. Centralized Depository Attack** -- Centralized depository, clearing and settlement services for equity and debt markets have been established in many countries over the  past 5 years. The typical CDS provides its services with an online computer system with participants having direct online access to the system. Transfer of settlement funds occurs through the central bank the same-day funds. Here is an example of regulation and technology design in supervised arenas not keeping pace with best practice. Since 9-11, a distributed network with significant redundancies is considered best practice. However the debate continues. Pushing forward with a consolidated platform given the significant concerns is not wise and the pros and cons should be looked at dispassionately and with great care. If a consolidated platform is used  since this is the delta of the settlement and clearance functions these facilities must maintain maximum security. The issues here are design and function, as well as centralizing high value assets. These are complicated issues. So how does one design a central depository system that is connected to the Internet or open network with sufficient back up, resilience, robustness and safeguards to mitigate the potential of compromising a critical point of failure.  Staged  cyber-attacks are now feasible in most countries due to the reality that CDS’ are built within the Internet Protocol (IP) environment.  The potential for reputational, operational and even systemic risks associated with poor non-layered security arrangements<sup>17</sup> upon these institutions is high.

Over the past few years cyber attacks have grown in complexity, sophistication and now represent powerful forms of targeted customized economic weapons that can destroy critical databases and render serious financial harm in an incredibly short amount of time. As countries work to create stock exchanges and central depositories, it is imperative to chronicle the lessons

> 13 Although this is possible the effects of doing so are not yet known.

> 14 A malicious program such as a virus or a worm, hidden in an innocent-looking piece of software, usually for the purpose of unauthorized collection, alteration, or destruction of information.

> 15 IRC a.k.a.  Internet Relay Chat

> 16 For additional information, please see Tom Kellermann, _Mobile Risk Management_ , World Bank March 2002.

> 17 The World Bank’s **Technology Risk Checklist v. 8.2** attempts to highlight the 12 layers of proper network security in detail.