Brokerage Instant Messages Must Be Saved

DrEnter writes "According to an AP story on Yahoo!, the National Association of Securities Dealers (NASD) has told its members that they must keep a copy of all instant messages sent or received by employees for at least three years. This is similar to their requirements on keeping e-mail, although technically not nearly as easy. The NASD is a self-regulatory organization, and U.S. federal law requires almost all of the 5,300 U.S.-based securities firms and brokerages to be a member of it. There's a news release from the NASD concerning the requirement - it looks like the daunting technical issues have already resulted in some firms banning the use of IM completely."

daunting technical issues?

[Surak]

What daunting technical issues? Nearly every instant messaging client has the ability to always log conversations. Simply standardize the clients that can be used, make sure that conversations are logged, and lock down the configs so that brokers can't change them. I see no daunting technical issues here.

What's the value?

[monkey_tennis]

I struggle to see the value in this. If a broker wants to have an 'off the record' conversation they could still use their mobile phone or some other mechanism. Doesn't there come a point where you have to acknowledge that not all communication that takes place at a place of work is 'owned' (in a responsibility-for sense) by the employer?

"Daunting technical issues"??

[The-Bus]

You mean, like the logs you can keep in ICQ? And if AIM/others doesn't support it, don't you think AOL will implement it pretty damn quickly so they don't lose market share in that industry?

Foolish...

[andreMA]

I can see drawing an analogy between email and postal mail and requiring the saving of that correspondence, but IM is better treated as telephone conversation -- which apparently isn't required to be saved.

This is understandable

[Millbuddah]

Considering the recent media frenzy over Martha Stewart's case regarding insider trading, this really shouldn't come as much of a surprise. They're only trying to cover their own ass by having records for evidence if any insider trading information is being passed along with these instant messaging programs.

Re:daunting technical issues?

[muffen]

As you said, they have the ability to log it on a client level. Imagine a company with 500 000 machines. Are you going to collect logs from each and every one every single day?? Even if you saved the logs on a network drive, do you want 500 000 different files per day?

The difficulty is logging the traffic on a server level. The reasons are many. I think this article [securityfocus.com] describes them fairly well.

Basically, IM traffic tries to hide itself, generally as HTTP traffic. Yahoo for example prepends a HTTP header to all packets, thereby being disguised as a HTTP GET request. AOL/ICQ/MSN has the ability to use HTTP Proxy servers, and AOL provides www.proxy.aol.com for free (port 80, no pass). MSN will auto-configure itself to use a proxy server if direct access is blocked.

Here's the result of logging IM traffic on a client level. [com.com]

Re:daunting technical issues?

[arkanes]

Missing the point - in this case, all the logging is done on client machines, outside the direct control of the support staff. That'd be a disaster if, say, someones hard drive failed and the log was lost, and then they were sued. Email is easy because you just mirror it on a server. You'd need some sort of complicated transparent proxy to log normal IMs, and that wouldn't work with encrypted conversations.

In other words - yes, it can be done. No, it's not trivial.

Makes sense to me

[jamie(really)]

Brokerage firms make deals minute to minute, and conversations with a broker are legally binding. There isnt time to fax a contract back and forth. If you phone anyone at a brokerage firm, you will be recorded. Something to remember before you phone your mate and tell them about your weekend in ibiza. I totally understand why banks would view instant messages as the 21st century equivalent of a phone converstaion. Get over it!

Re:What's the value?

[the uNF cola]

The slightest word from a worker's mouth on the status of the stock market in terms of purchasing, can give a hint to a stock owner to buy or sell.

This is insider trading, trading with information from the inside.

The proxy'ing is simply a restrictive measure. It makes it easier to detect. Yes, you can't monitor all communications, but it makes it harder to do live communications, especially since the sound of typing doesn't say WHAT you are typing.

After hours stuff you can't prevent, but then again, after hours information is stale and is less usefull... though could be useful none-the-less.

Re:daunting technical issues?

[Surak]

Now you're thinking. See what I mean? Put a smart IT staff to work, and the solutions just start pouring out. As I said, there are no daunting technical issues here.

Re:daunting technical issues?

[bmongar]

Nearly every instant messaging client has the ability to always log conversations

Client side logging is not sufficient. An employee can turn that off or delete the logs. The logging would have to be done server side. That would require a corporate IM solution which would log. I work for a company effected by this law. They don't allow any external or web based e-mail access for the same reason, they can't log it unless you go through their server.

Re:What's the value?

[Anonymous Coward]

"If a broker wants to have an 'off the record' conversation they could still use their mobile phone"

Err, exactly how off-the-record did they want? Do you know anyone who works at a telephone company?

Re:What's the value?

[sagneta]

It's not the employer that is making this requirement. The SEC has regulated such communication since its inception in 1934 in accordance with the Securities ACT of 1933 and the Securties and Exchange ACT of 1934. This is the law. Period.

Insider trading and information dissemination is strictly regulated to prevent classic insider stock manipulation gambits. To get some idea of how that worked you can read "Reminiscence of a Stock Operator " first publised in 1924.

Sam Waksel who was found guilty of violation of several securities laws and could have been hung up on obstruction of justice to boot is now spending 7 years in prison. He could have gotton 40.

The laws have become stricter more recently. Just before the bubble burst Congress enacted more legislation that prevented companies from providing non-public information to traders, analysists and the like. They mean it. Siebel executives during a dinner recently that off the cuff mentioned some data to an analysist are now having to explain themselves to the SEC. SEC is in a bad mood these days.

The point that is lost outside the industry is that the witch hunt is on. This happens after every debacle. It is not a technical issue. The IM infrastructure *must* meet SEC and NASD ( 1938 ACT ) rules and regulations otherwise the companies face prosecution and the individuals lose Series 7.

I am actually astonished NASD waited this long. Brokerage firms are all ready rushing to comply in 2003 because it has been assumed this would happen.

FYI

Most firms have done this for a long time.

[michael7]

I work at one of the large investment banks and instant messaging has become a large part of how traders do business. They communicate with people from other firms, quote prices, and even make trades. All of this is much more efficient and effective than email or even the phone. The recording of these communications is mostly there to settle disputes. If I quote a price to you over IM and you accept the trade is done, and if later you come back and dispute the price, there needs to be some way to settle it. This is the main reason phone calls and emails are all recorded and saved. It is a good deal for the banks, along for the SEC when investigations come up.

Re:record everything

[Anonymous Coward]

Well, I work for a large trading company, and we installed IM here a few months ago. It was enabled for about 3 weeks, and then they decided it needed to be archived, and they couldn't do it, so it was disabled.

This is for all employees, not just brokers or in communications with clients.

So, in spite of what the press release says, paranoid companies are following these rules for all employees.

Re:Where I work...

[Eevee]

Timeline:

0700 - Get coffee, gossip with coworkers.

0800 - Install PuTTY on company computer.

0815 - ssh to home.

0817 - Get escorted out of the building by two rather large and unfriendly gentlemen.

0900 - Apply for unemployment insurance.

Re:daunting technical issues?

[Anonymous Coward]

Missing the point - in this case, all the logging is done on client machines, outside the direct control of the support staff.

Why not configure the IM software to log to a shared network location?

You'd need some sort of complicated transparent proxy to log normal IMs, and that wouldn't work with encrypted conversations.

No necessarily. With a standardized, locked-down machine configuration you could configure everything on the machine to use whatever proxy options you want. Nothing much would help log encrypted conversations, but, again, if you have control of the PC you can prevent them from using encryption.

Tunneling

[borgasm]

Unless you have a fantastic firewall, instant messaging loggin can be circumvented by tunneling.

Currently, I have an SSH tunnel to my home, over which I encrypt all traffic, web, email, and instant messaging.

Pefereably, I would like to have an encrypted connection everywhere (thank you GAIM plugins), but this will have to do.

It is useless to log the SSH packets...so the only solution I see is to install a PacketShaper, and maybe filter out all SSH...but surely somebody must be using SSH legitimately...

Bottom line: logging communications is very difficult....

Firewall

[bobthemuse]

I've seen this done for several small facilities using almost any kind of firewall which supports masquerading (which would be almost all of them). Simple forward all the IM traffic to a dedicated logging machine, which then forwards it to the true IM server. By blocking access to the IM server on all but the redirected ports, there is no way to bypass it. How is this technically difficult?