The Market Ticker
Commentary on The Capital Markets

No surprises here...

The IRS believes that criminals behind a major security breach that allowed them to access tax information from more than 100,000 U.S. households were based in Russia, sources confirmed to Fox News Wednesday.

A well-placed cyberintelligence source familiar with the investigation into the breach told Fox News that the attack, which breached the IRS system, originated out of Russia. Additionally, the IRS alerted the Department of Homeland Security following the breach, a federal law enforcement official said.

No kidding?  Typically these sorts of things come from either Russia, China, or one of the Russian satellite nations.  That's been true for a long time so there's no surprise here.

I'll tell you what is surprising -- how many institutions of various sorts will try to sweep under the rug a potential compromise that has severe consequences if it is realized rather than absorb the expense involved in closing the hole.

I'm aware of one such incident right now that involves a private key that had its integrity violated twice within the organization -- first by placing it somewhere it shouldn't have ever been and then a second time by stripping the (very long and hard to remember) password from it.

Properly mitigating this violation of protocol would be a serious pain in the ass.  Every certificate produced with that key has to be reissued, as when the certificate that it is paired with is revoked all the old certificate/key pairs issued with it are immediately invalidated.  This would involve substantial hassle and cost (quite substantial, in fact.)  The "easy" thing is to pretend it never happened, "delete" it from the places it shouldn't be and then believe (more like "pray!") that when that "rm" command is issued it really is deleted, there really are no snapshots anywhere that still have it and nobody copied or sniffed it in the meantime.

Now there's no evidence right now that the key actually got into someone's hands that shouldn't have it.  But that doesn't mean that it didn't, it just means that there isn't evidence of misuse at this point.  It's not possible to know if it was intercepted or copied somewhere else (say, by some Russian jackwad) while it traveled over a wire somewhere or resided on a machine in unencrypted form.  There's just no way to know that with certainty.

Organizations don't like the costs involved in rectifying these sorts of screw-ups, especially if there is no immediate evidence of misuse.  But that's the reason you bother to look for potential breaches of protocol and when you find one you take these steps; by the time the evidence of misuse shows up you're screwed!

Security is a process, not a product.  You have to put the proper checks and balances in place and when the alarms go off telling you something went wrong you have to address the problem at its core, not pray that you "got away with it."

The IRS "breach" appears to have come about as a result of trading convenience for security.  There are a number of things that could have been done to make that breach implausible; a simple one would be to refuse to allow data to be retrieved over that portal without something that is very hard to get from other than the proper person and isn't a thing anyone else would ever ask about or know -- say, for example, the specific amount off a given line from last year's tax form.  Further, if you get it wrong more than once you're locked out for a material period of time to prevent guessing from being fruitful for the crooks.

Bad design or refusal to act when you find out that a violation of your security protocols has taken place is how you get hosed.  What continues to amaze me is that in most of these breaches (various POS compromises, etc) there are specific rules that are supposed to be followed and in many cases they are not suggestions; they're contractual requirements.  Rather than audit for compliance and assessing serious fines when violations are found even though no theft has yet taken place most large institutions are given a pass.

But then the wolf comes and, finding the gate open, eats your chickens.

View this entry with comments (registration required to post)
 

When the "embassy" in Benghazi was attacked I said at the time that the available public information did not support any part of the government narrative, but rather was consistent with a planned military-style "hit" on the location and that the people involved were seeking something specific and knew it was there.  It was neither spontaneous nor speculative as the exhibition of coordinated command and control over that operation by the rebels was clear and convincing.

Nobody wanted to get into that on the political side and it is my belief that the reason for same is that doing so would blow wide open the fact that plenty of really stupid if not lawless behavior had been going on over there and both sides of the aisle knew it and failed to stop it.  This is why it was "safe" in terms of inquiry; while you can pin the acts on the Obama administration it was hardly covert without Republican knowledge and therefore silent assent.

Now, we have some evidence.

Recently released emails detail then-Secretary of State Hillary Clinton's interest in arming Libyan opposition groups using private security contractors before the fall of Muammar Qaddafi in 2011 – though at the time, the opposition was not formally recognized by the U.S. or United Nations, which prohibited arming without following strict guidelines and oversight.

The issue remains so sensitive that the emails recently released by the State Department redacted a key line on the matter. But the unredacted version of the same email, released to the congressional Benghazi Select Committee and first posted by The New York Times last Thursday, showed Clinton appearing to endorse the idea of using private contractors to her then-deputy chief of staff, Jake Sullivan.

It's not a violation of the law (international or otherwise) to think about it.  And thus far there's scant hard evidence that we actually directly made such a shipment in the immediate period before the attack.

But, there is evidence that we knew about Libya shipping arms, including MANPADs, into Turkey -- including one shipment just a few days before the Benghazi installation was sacked:

Through shipping records, Fox News confirmed that the Libyan-flagged vessel Al Entisar, which means "The Victory," was received in the Turkish port of Iskenderun -- 35 miles from the Syrian border -- on Sept. 6, 2012, five days before the Benghazi terrorist attack. The cargo reportedly included surface-to-air anti-aircraft missiles, RPG's and Russian-designed shoulder-launched missiles known as MANPADS.

There are plenty of questions that remain unanswered and as usual all the suspects are hiding being "that's classified."  That's good and well provided that nobody was acting contrary to the law and/or official government (or international) policy.

If they were, however, then that's not only a poor excuse it ought to be good for an additional obstruction of justice charge in due time, provided the law was violated.

But even if it wasn't -- that is, even if there was in fact a proper Presidential finding and this was a "legitimate" covert operation under the law, that doesn't excuse the stupidity of it nor does it exonerate Hillary -- or Obama -- from the just political consequences of what amounted to arming what became ISIS!

Again, I repeat my question from the time: Exactly what was in that embassy-cum-CIA-outpost that was worth a coordinated military assault and how does this tie into the complicity of our State Department, including one Hillary Clinton, in deliberately misleading the press and public as to the circumstances and motivations for that assault?

As to Hillary's "What difference does it make?" defense I will point out that Chris Stevens along with several of our troops who valiantly held off said assault and were denied critical reinforcement by the chain of command above them, probably reaching either Hillary or President Obama himself, are all dead as a consequence of said denial.

View this entry with comments (registration required to post)
 

Last night a very curious thing happened.

The Shanghai market, for those who haven't been living under a rock, has been on an absolute tear this year, rising some 70%.  That's reminiscent of the Nasdaq in 1999 and early 2000, of course.... during which it doubled, and in fact if you just look back a couple more months on the Shanghai you find the same pattern.

Last night, however, it was down 6.4% on the back of a gap up two days ago and then a failure to follow through over the previous two sessions.

Technically, the market is in a very-clear blow-off pattern; the trendline from back around November which confirmed in mid-March is way below the current price, today sitting around 535-540.  Last night's close was 630, or another ~13% decline.  As such those who look at last night's slaughter as something of moment may well be right, but the more-serious problem here is the vulnerability that decline presents, as anyone who bought into the index on a broad basis since roughly mid-March has no trend protection nor any clear indications on a technical basis that they should head for the door until a roughly 20% loss has been incurred.

On a monthly closing basis in the United States it's even worse than in Shanghai; there has been no third confirming trendline contact and on a weekly basis while we got close to confirmatory contact twice in 2012 it never happened.  This means that for those in the United States they have no clean signal either, and the level at which one would get either confirmatory contact (and a bounce) or a failure is at SPX 1800, a decline of close to 20%!

One must be a student of history in the markets to avoid making the same mistake over and over.  This very same blow-off pattern has shown up in both of the last two bubbles -- the Tech bubble and blowup and the housing bubble. In the 1990s your last confirming touch of the advancing trendline in the SPX happened in late 1998; you didn't know that it was going to fail until the start of 2001.  There was, however, a very scary false break at the end of 1998.  If you sold there you "missed" a 50% run-up in the S&P over the next year and a half, roughly, but if you bought any time during it you also had no clean indication whether the former trend was real any more and you didn't know you were in trouble (if you believed it was valid) until you broke 1300 -- a loss of close to 20% from the highs.

In the "recovery" from 2003 (all of which was a bubble) your first trend setting level that turned out to be valid didn't come until more than three years later in mid 2006.  The problem is that there was no secondary confirmation at all until the swoon in mid-2007, but the good news is that it did fail shortly thereafter at the end of the year (at which point I was warning everyone to get the hell out!)

In the 1990s Tech Wreck you had no warning in the Nasdaq that was worth anything at all; the last "touch" of a confirmed trendline was in late 1998 after which the NDX tripled and the trend break didn't come until 2001 when virtually all of those gains were erased.  If you bought after that last touch you had zero protection of any sort, which was a big part of why I declined to come out and play in the late 1990s.  This time around it's a bit better in tech in that the last confirmation of the trend was in late 2012 but the confirmatory level is at ~3500 right now which means you get to risk 30% on price before you know if the trend is going to break or not.

My point is simply this: This particular so-called "recovery" has all of the same sort of price action in this regard as did the last two bubbles, neither of which was founded on "real" anything.

Those who claim "there is no bubble" and this is a "secular" bull market are full of crap, in short.  What the chart says is that price advances are happening in a geometric (that is, exponential) fashion which is exactly what happens in a bubble.  Indeed, that's the marker of a bubble!

The problem is that this bubble is much worse than the last one and has characteristics more-similar to the 1996-2000 run than the 2006-07 one.  In 2007 you at least had reasonably fair warning on the impending collapse in the SPX.

This time around you're not going to know when it hits the fan until you've taken at least a 20%, and quite-possibly as much as a 30% loss.

No thank you.

View this entry with comments (registration required to post)
 

Damn....

View this entry with comments (registration required to post)
 

2015-05-28 06:00 by Karl Denninger
in Company Specific , 185 references
 

I know quite a few people who were enamored with this stock and had fairly large positions in it....

That's basically a round-trip from 2013.

smiley

PS: I suspect there will be many more cries just like this one in the coming weeks and months.....

View this entry with comments (registration required to post)
 

Main Navigation
MUST-READ Selection:
No Kidding? Stan Sees The Problem?

Full-Text Search & Archives
Archive Access
Legal Disclaimer

The content on this site is provided without any warranty, express or implied. All opinions expressed on this site are those of the author and may contain errors or omissions.

NO MATERIAL HERE CONSTITUTES "INVESTMENT ADVICE" NOR IS IT A RECOMMENDATION TO BUY OR SELL ANY FINANCIAL INSTRUMENT, INCLUDING BUT NOT LIMITED TO STOCKS, OPTIONS, BONDS OR FUTURES.

The author may have a position in any company or security mentioned herein. Actions you undertake as a consequence of any analysis, opinion or advertisement on this site are your sole responsibility.

Market charts, when present, used with permission of TD Ameritrade/ThinkOrSwim Inc. Neither TD Ameritrade or ThinkOrSwim have reviewed, approved or disapproved any content herein.

The Market Ticker content may be reproduced or excerpted online for non-commercial purposes provided full attribution is given and the original article source is linked to. Please contact Karl Denninger for reprint permission in other media or for commercial use.

Submissions or tips on matters of economic or political interest may be sent "over the transom" to The Editor at any time. To be considered for publication your submission must include full and correct contact information and be related to an economic or political matter of the day. All submissions become the property of The Market Ticker.