8 the investor of this risk or should they be permitted to use riskier means to trade without their client’s knowledge and if so who bears the burden of any loss that may result.

**3. Distributed Denial Of  Service (DDOS) attack**<sup>12</sup> —DDOS attacks could take several forms. First a hacker may attempt to flood (overwhelm the network with vast amounts of data) a brokerage company’s network just before the close of market, to prevent it from placing fresh quotes before the end of the day. This could result in penalties and subsequent “reputational risk”. In a delivery vs. payment scenario the stock is not transferred to the buyer until payment is received. If payment orders are kept from being delivered then the stock will not transfer. In an Straight Through Processing (STP),TP, T + 0 environment this scenario carries significantly more risk.  This scenario is particularly plausible in the New York Stock Exchange’s new wireless trading model. Although the Exchange uses fiber optics as its primary transfer channel, it has installed a WLAN (wireless local asynchronous network) to serve as the redundant backup for those lines in the event of another terrorist strike.  Unfortunately using the WLAN poses a significant vulnerability to the integrity of the stored market data. Or the hacker may cause the system to fail to respond to a time-based transaction(s) or a trade(s). For example, a system overload/failure, could delay the response time and cause a Call Option to be placed after its expiry date. Who is liable for a failed trade in that situation?

**4. Market Data Sabotage** —Market participants are heavily reliant upon the market data they receive from entities like Bloomberg’s and/or Reuters as well as online chat rooms and discussion forums. Hackers have the potential to corrupt the data or insert erroneous data once it leaves the perimeters of financial information disseminators and aggregators such as Bloomberg’s and Reuters. The integrity of the data can thus be called into question because it can be digitally manipulated.  Since trading positions often are directly related to the interpretation of such data such error could result in loss of investor confidence or even panic once discovered. As importantly, chat rooms and discussion forums are fertile areas for manipulators to deposit disinformation. Because this can be done anonymously, quickly and with little if any opportunity to investigate in a timely manner there is little chance that such an event would ever be prosecuted.

**5. Currency Trading Scenario** —Currency trading is volatile and is more often than not dependent on fractions of seconds in trading positions.  Suppose that the Euro drops in value relative to US dollars effective at 12:00:00 EST on a particular day.  The holder of Euros is likely to wish that they had sold Euros before its drop in value.  Suppose that the server time tagging the buy/sell orders is being controlled by the reception of GPS positioning and timing signals.  A GPS electronic spoofing attack could be launched against the GPS time controlled transaction server.  In order to “back-date” the sell order to show that it occurred before the Euros decline, the attacker alters the GPS timing (for example, 11:59:50 EST) thereby causing the system to order the sale and time stamp at a time prior to the decline in the Euros value.  The

> 12 A type of electronic attack in which malicious code is used to execute any type of system overflow or jam, thereby causing the server to shut down and deny service to its users.