It is over a week since the National Stock Exchange (NSE) came to a slow, grinding halt on 24 February 2021 and we are still none the wiser about exactly what transpired that day.
While conspiracy theories on social media and trader networks abound, the market regulator and the Exchange are silent, barring a hasty, and shockingly inaccurate, press release from the Securities and Exchange Board of India (SEBI).
It is finance minister (FM) Nirmala Sitharaman’s statement that has corrected the picture with the admission that ‘interoperability’ between exchanges failed to work (contrary to SEBI’s press release) and that the stoppage of trading was a serious embarrassment.
Otherwise, it would probably have been passed off by SEBI as a minor ‘glitch’ in the largest derivatives market in the world.
Since the FM’s statement, we learn from Business Standard that SEBI’s technical advisory committee (TAC) headed by the no-nonsense Prof Ashok Jhunjhunwala, has been “mandated to probe the trading halt and fix accountability” and that it will “send its findings and recommendations to SEBI’s whole-time member (WTM) Madhabi Puri Buch.”
Unfortunately, the report raises more questions than it answers. For starters, the TAC, by its very mandate, is bound to call for information about why trading ground to a halt on 24th February.
Going by past precedent, it is unlikely that the TAC will ‘fix accountability’. Even in the much larger algo scam of 2015, the TAC never got into the job of ‘fixing accountability’.
In the Alice in Wonderland world of Indian regulation, it was NSE which was repeatedly asked to ‘fix accountability’ for its own sins, which it has avoided doing.
SEBI-TAC had also ordered four separate investigations (Deloitte’s forensic audit, SEBI-TAC’s own, Ernst & Young and ISB Hyderabad), most of them commissioned by NSE, but no accountability was fixed.
Also, the chairmen of SEBI’s advisory committees normally take their findings to the chairman and not a WTM, unless there is a specific reason why he is out of the picture this time.
Fortunately, TAC chairman Prof Ashok Jhunjhunwala is both upright and an expert on telecom and technology. And he does not seem to be buying the excuse of telecom failure, failure to activate the disaster recovery (DR) site and the regulator’s claims about interoperability of exchanges having worked.
Here’s information I have pieced together over the past few days, while waiting for SEBI and NSE to respond to specific queries sent to them.
A Cyber Attack Is Not Ruled Out
Those connected with high-tech systems insist that the manner in which NSE’s operations shut down have all the signs of a cyber attack, rather than a telecom failure.
“It was like a slow moving train wreck,” says one expert, pointing to how the system seems to have shut down very gradually from the time the stock indices stopped updating and trades were frozen.
This source says all major companies, especially trading and banking systems, are in a constant struggle to remain one jump ahead of hackers and cybercriminals across the world.
He points to information readily available in the public domain which suggests that there was a slow shutdown.
Some of the earliest tweets indicate that the problem began around 9.54am when traders couldn’t place orders or exit and the trades seemed to have frozen. Initially, they thought their brokers were at fault.
By 10.06am the problem had affected other parts of the system. Indices were not getting updated and the risk management system of NSE Clearing Ltd was, probably, next to be affected.
But, as the tweet below shows, there was neither an announcement nor a closure by NSE until after 11.11am. In fact, the NSE system seems to have slowly shut down over the next hour and 40 minutes.
NSE closed the derivatives market at 11.40am and the cash market 11.43am with an unexplained gap of three minutes on an Exchange where algorithms ensure that massive trades, valued at hundred of crore rupees, are executed in milliseconds and microseconds.
So @NSEIndia exchange problem started at 10:06 am now it’s 11:11 no one has clue by when it will get rectified at exchange with no margin update from exchange site
This slow shutdown, say experts, is a sign of hacking rather than a telecom issue. The possibility is not far-fetched.
Remember, it was only on 1st March that Maharashtra power minister Nitin Raut admitted that the massive grid failure in the state in October 2020 was not a technical failure but a Chinese cyber attack, as first reported by The New York Times.
Hopefully, the SEBI-TAC will commission the right experts to get at the truth and also tell us why NSE took so long to shut trading and why standard operating procedures (SOPs) were not followed regarding closure and re-opening of markets with extended trading hours. Now, let us look at some specifics.
NSE’s press release claimed that it “has multiple telecom links with two service-providers” but both reported ‘instability’. It has still not mentioned which telecom service-provider failed.
Tech experts, who deal with disaster recovery operations for large multinationals and tech companies, openly disbelieve the telecom failure claim and point out how all work with multiple service-providers and have a ‘ring’ system for backup.
One source says, “5% of all orders and 95% of all trades come from the co-location servers within the NSE building,” if there was telecom instability, most brokers and traders would have reported connectivity problems; but nobody did. Moreover, if the telecom issue was so drastic, communications failure would have brought trading to a halt immediately.
Interoperability and Disaster Recovery:
We learn that SEBI called the stock exchange officials for a meeting on 1st March to discuss the issue of interoperability of clearing houses. According to sources, the complete lack of knowledge and expertise among SEBI’s top officials was painfully evident at the meeting which was trying to find a solution to the ‘problem’ without a root cause analysis to identify the problem in the first place.
This is the 10th trading glitch at the NSE in four years and, yet, SOPs in times of a market failure, which are interminably discussed at IOSCO (International Organisation of Securities Commissions) meetings, were forgotten when the big outage happened. The failure was on three fronts:
1)Interoperability between exchanges, which would have allowed trading to switch to the Bombay Stock Exchange (BSE) and prevented losses, did not happen because NSE Clearing Ltd was shut.
2)Standard protocols, with regard to re-opening markets, keeping market participants informed, providing enough notice and rolling back of trades to avoid losses to investors, were ignored.
3)NSE failed to switch to the disaster recovery (DR) site, which is reportedly tested every quarter under a SEBI mandate.
On all three issues, the regulator is as much to blame as the Exchange, since SEBI’s own release says that its officials were constantly in touch with NSE and party to all decisions. It is here that conspiracy theories abound.
Why then has SEBI called for an explanation on NSE’s failure to activate the DR site, when it was constantly in touch with the Exchange?
Some believe that DR was not activated because large traders, who invest heavily in NSE’s co-location (Colo) servers, may have lost their advantage a day before options expire.
My sources say that Colo servers are not replicated at DRs, and this may have kept large traders out of the market if the problem was not fixed that day. If true, this raises serious questions about whether DR would ever be activated if Colo is not replicated at the disaster recovery site.
When SEBI’s TAC investigates what happened on 24th February, will ‘fixing of accountability’ extend to SEBI officials who allowed SOPs to be flouted? Ideally, the TAC should be allowed to investigate the issue independently and submit its findings directly to the finance ministry.