28/9/19: Evidence of Systemic Risk from Major Cybersecurity Breaches

In our post for Columbia Law School's CLS Blue Sky Blog, myself and Shaen Corbet explain in non-technical terms our ground-breaking findings on systemic nature of cybersecurity risks in financial markets:

• LexBlog link: https://www.lexblog.com/2019/09/26/evidence-of-systemic-risk-from-major-cybersecurity-breaches/
• CLS link: http://clsbluesky.law.columbia.edu/2019/09/27/evidence-of-systemic-risk-from-major-cybersecurity-breaches/
• Original working paper: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3033950
• Published paper: https://www.sciencedirect.com/science/article/pii/S1057521919300274.

Our study is the first in the literature showing evidence of systemic contagion from cyber attacks on one company to other companies and stock exchanges.

Based on these findings, we have a chapter forthcoming in an academic volume on the future of regulation, proposing a novel mechanism for regulatory detection, monitoring and enforcement of cybersecurity risks. We will post this chapter when it goes to print, so stay tuned.

20/9/19: New paper: Systematic risk contagion from cyber events

Our new paper, "What the hack: Systematic risk contagion from cyber events" is now available at International Review of Financial Analysis in pre-print version here: https://www.sciencedirect.com/science/article/pii/S1057521919300274.

Highlights include:

• We examine the impact of cybercrime and hacking events on equity market volatility across publicly traded corporations.
• The volatility generated due to cybercrime events is shown to be dependent on the number of clients exposed.
• Significantly large volatility effects are presented for companies who find themselves exposed to hacking events.
• Corporations with large data breaches are punished substantially in the form of stock market volatility and significantly reduced abnormal stock returns.
• Companies with lower levels of market capitalisation are found to be most susceptible to share price reductions.
• Minor data breaches appear to be relatively unpunished by the stock market.

7/9/17: What the Hack: Systematic Risk Contagion from Cyber Events

We just posted three new research papers on SSRN covering a range of research topics.

The second paper is "What the Hack: Systematic Risk Contagion from Cyber Events", available here: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3033950.

Abstract:

This paper examines the impact of cybercrime and hacking events on equity market volatility across publicly traded corporations. The volatility influence of these cybercrime events is shown to be dependent on the number of clients exposed across all sectors and the type of the cyber security breach event, with significantly large volatility effects presented for companies who find themselves exposed to cybercrime in the form of hacking. Evidence is presented to suggest that corporations with large data breaches are punished substantially in the form of stock market volatility and significantly reduced abnormal stock returns. Companies with lower levels of market capitalisation are found to be most susceptible. In an environment where corporate data protection should be paramount, minor breaches appear to be relatively unpunished by the stock market. We also show that there is a growing importance in the contagion channel from cyber security breaches to markets volatility. Overall, our results support the proposition that acting in a controlled capacity from within a ring-fenced incentives system, hackers may in fact provide the appropriate mechanism for discovery and deterrence of weak corporate cyber security practices. This mechanism can help alleviate the systemic weaknesses in the existent mechanisms for cyber security oversight and enforcement.

7/9/17: Long-Term Stock Market Volatility & the Influence of Terrorist Attacks

We just posted three new research papers on SSRN covering a range of research topics.

The first paper is "Long-Term Stock Market Volatility and the Influence of Terrorist Attacks in Europe", available here: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3033951

Abstract:

This paper examines the influence of domestic and international terrorist attacks on the volatility of domestic European stock markets. In the past decade, terrorism fears remained relatively subdued as groups such as Euskadi Ta Askatasuna (ETA) and the Irish Republican Army (IRA) relinquished their arms. However, Europe now faces renewed fear and elevated threats in the form of Middle Eastern and religious extremism sourced in the growth of the Islamic State of Iraq and Levant (ISIL), who remain firmly focused on maximising casualty and collateral damage utilising minimal resources. Our results indicate that acts of domestic terrorism significantly increase domestic stock market volatility, however international acts of terrorism within Europe does not present significant stock market volatility in Ireland and Spain. Secondly, bombings and explosions within Europe present evidence of stock market volatility across all exchanges, whereas infrastructure attacks, hijackings and hostage events do not generate widespread volatility effects. Finally, the growth of ISIL-inspired terror since 2011 is found to be directly influencing stock market volatility in France, Germany, Greece, Italy and the UK.

23/1/17: Regulating for Cybersecurity: A Hacking-Based Mechanism

Our second paper on systemic nature (and regulatory response to) cyber security risks is now available in a working paper format here: Corbet, Shaen and Gurdgiev, Constantin, Regulatory Cybercrime: A Hacking-Based Mechanism to Regulate and Supervise Corporate Cyber Governance? (January 23, 2017): https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2904749.

Abstract: This paper examines the impact of cybercrime and hacking events on equity market volatility across publicly traded corporations. The volatility influence of these cybercrime events is shown to be dependent on the number of clients exposed across all sectors and the type of the cyber security breach event, with significantly large volatility effects presented for companies who find themselves exposed to cybercrime in the form of hacking. Evidence is presented to suggest that corporations with large data breaches are punished substantially in the form of stock market volatility and significantly reduced abnormal stock returns. Companies with lower levels of market capitalisation are found to be most susceptible. In an environment where corporate data protection should be paramount, minor breaches appear to be relatively unpunished by the stock market. We also show that there is a growing importance in the contagion channel from cyber security breaches to markets volatility. Overall, our results support the proposition that acting in a controlled capacity from within a ring-fenced incentives system, hackers may in fact provide the appropriate mechanism for discovery and deterrence of weak corporate cyber security practices. This mechanism can help alleviate the systemic weaknesses in the existent mechanisms for cyber security oversight and enforcement.

2/1/16: Financial digital disruptors and cyber-security risks

My and Shaen Corbet's new paper titled Financial digital disruptors and cyber-security risks: paired and systemic (January 2, 2017), forthcoming in Journal of Terrorism & Cyber Insurance, Volume 1 Issue 2, 2017 is now available at SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2892842.

Abstract:
The scale and intensity of digital financial criminality has become more apparent and audacious over the past fifteen years. To counteract this escalating threat, financial technology (FinTech) and monetary and financial institutions (MFI) have attempted to upgrade their internal technological infrastructures to mitigate the risk of a catastrophic technological collapse. However, these attempts have been hampered through the financial stresses generated from the recent international banking crises. Significant contagion channels in the aftermath of cybercriminal events have also been recently uncovered, indicating that a single major event may generate sectoral and industry-wide volatility spillovers. As the skillset and variety of tactics used by cybercriminals develops further in an environment of stagnating and underfunded defensive technological structures, the probability of a devastating hacking event increases, along with the necessity for regulatory intervention. This paper explores and discusses the range of threats and consequences emanating from financial digital disruptors through cybercrime and potential avenues that may be utilised to counteract such risk.

11/6/16: Sovereign to Corporate Risk Spillovers

As noted recently in my posts on the new iteration in the Greek Crisis, we are now into the sixth year (officially) of the Euro area sovereign debt crisis. Alas, of course by unofficial, yet more realistic metrics, we are really into the ninth year of the crisis (who cares what you call it).

Now, you might just think that at the present, there is little to worry about, as the crisis seemed to have abated, if not completely gone away. But the problem is that the real lesson from the 2008-present crisis should be exactly the acquired awareness that such thinking is dangerous.

Here’s why. In a recent ECB working paper,  Augustin, Patrick and Boustanifar, Hamid and Breckenfelder, Johannes H. and Schnitzler, Jan, titled “Sovereign to Corporate Risk Spillovers” (January 18, 2016, ECB Working Paper No. 1878: http://ssrn.com/abstract=2717352) “quantify significant spillover effects from sovereign to corporate credit risk in Europe” in the wake of the announcement of the first Greek bailout on April 11, 2010.

“A ten percent increase in sovereign credit risk raises corporate credit risk on average by 1.1 percent after the bailout. These effects are more pronounced in countries that belong to the Eurozone and that are more financially distressed. Bank dependence, public ownership and the sovereign ceiling are channels that enhance the sovereign to corporate risk transfer.”

We should worry.

1) Corporate and sovereign bond risks are tied at a hip. And guess what we are witnessing today? A massive bubble in sovereign bonds and a bubble in corporate bonds. When one blows, the other will too. Be warned, per my contribution to the Summer edition of Manning Financial (LINK HERE).

2) Eurozone countries are at a greater contagion risk. Doh… like we never heard that before. But, still, good reminder to remember. I wrote a paper on that for the EU Parliament not long ago (LINK HERE).

3) Bank dependence is bad for contagion - in a sense that it increases contagion, not reduces it. And guess what the Eurozone been doing lately via ECB’s policy and via CMU and EBU? Right… increasing bank dependency. (LINK HERE)

In short, things might be a bit brighter today than they were yesterday, but tomorrow might bring another hurricane.

19/12/2014: Russian Banks: Contagion exposures for Europe

From a different Deutsche Bank note, a handy chart plotting exposures of various Western banking systems to Russia.

Do keep in mind, same banks' exposure to Ireland was probably of a magnitude of 1/5th of their exposures to Russia, yet Irish banking system was deemed to be systemically important when it came to assessing the potential contagion from Anglo failure back in 2008.

17/12/2014: Some Ruble-Heavy Reading: Contagion, Reserves & Fundamentals

Some interesting set of articles on the topic I mentioned earlier on Irish radio and in the post here: http://trueeconomics.blogspot.ie/2014/12/16122014-russian-inflation-hot-but.html  - the topic of contagion from the run on Russian ruble to the global economy:

• First off, the Guardian on the destabilising effects of playing brinksmanship with Russia (not to excuse the equally destabilising effects of Russia playing its own brinksmanship): http://www.theguardian.com/commentisfree/2014/dec/16/russia-economy-west-vladimir-putin?CMP=twt_gu
• Second, RT article on subject of spillovers: http://rt.com/op-edge/215031-russian-ruble-crisis-aftershocks/ Note: the article quotes myself on the topic
• Third, FT Alphaville piece - tongue-in-cheek - on Russian external liabilities http://ftalphaville.ft.com/2014/12/16/2074181/russian-foreign-liabilities-in-perspective/ Give that a thought - these are owed to someone in the West (mostly in Europe).
• Fourth, Bloomberg View piece on spillovers: http://www.bloombergview.com/articles/2014-12-16/russias-problems-are-everyones-problems - not much in the way of factual, but on the money in general
• Fifth, a bit over-the-top, but important question of potential geopolitical response from Moscow here: http://www.businessinsider.com/what-will-happen-next-2014-12?IR=T
• Sixth, factual report on PIMCO effect from the Russian crisis: http://www.bloomberg.com/news/2014-12-16/russia-crisis-hits-pimco-fund-wipes-out-options-as-ruble-sinks.html
• Seven (update): WSJ on Ruble spillover to European companies: http://www.wsj.com/articles/rubles-decline-deepens-concerns-for-european-companies-1418760793

As an aside to the menu of options available to Russian Government, here is one of a 'limited capital control': http://www.nakedcapitalism.com/2014/12/how-putins-fealty-to-the-washington-consensus-made-his-currency-crisis-worse.html aka de-dollarisation of the retail deposits. Surely, that would just amplify pain for ordinary savers.

And another aside: in-depth analysis of the reserves position and demand for debt redemptions for Russia here: http://www.nakedcapitalism.com/2014/12/oil-ruble-ideology.html. Key quote from the article:

"We notice that the strong depreciation of the Rouble corresponds to a peak in repayments, but that the situation will loosen up in early 2015. It is sure therefore that the exchange rate will reverse its tendency in the first semester of 2015. The question is, up to what point? If the Rouble stabilizes around 50 roubles for 1 USD, inflation will be strong next year and could reach 12%. If we witness a rise in oil prices and the Rouble stabilizes around 40-42 roubles for 1 USD, the inflation rate could amount to merely 10%. Still, this implies that the Central Bank of Russia keep an eye on such establishments which could be tempted to speculate on the exchange rate, dragging it farther down than it should normally be. Explicit threats were made by President Putin at the occasion of his declaration of general policies before the chambers of parliament on December 4th. However spectacular it has been, the depreciation of the Rouble by no means puts into question the financial stability of Russia. The trade balance remains in excess, with an amount outstanding of 10 billion dollars a month. This is largely sufficient to face up to coming payments. The budget is actually profiting from this depreciation, which should allow the government to spend a little bit more in 2015. Russia will therefore remain one of the least indebted countries in the world, which is not necessarily an advantage and goes to show that, provided it takes up debts internally, the country wields over a strong potential for investment and development."

Another update: a must-read from Bloomberg's @Bershidsky on why sanctions are at best secondary when it comes to the run on the Ruble:  http://www.bloombergview.com/articles/2014-12-17/lift-sanctions-now-to-humiliate-putin