Like any development project, Prophesy had its geek squad of programmers and systems administrators to design protocols for security, interconnectivity, and the user interface. The team combined the joy of a Silicon Valley garage start-up with the can-do culture of the CIA in a unique effort to preempt terrorism using the same information that viewers see every day on Bloomberg TV.
The climax of Project Prophesy was a red team exercise in September 2003. Red teaming is a classic way of testing hypotheses and models by recruiting a group of experts as the “enemy,” then asking them to role-play scenarios designed to expose flaws in the original assumptions.
Our red team membership was like a Pro Bowl squad, with all-star traders from the biggest banks, hedge funds, and institutional investors in the world along with some noted academics. In addition to John Mulheren, the team included Steve Levitt, a professor at the University of Chicago and an author of Freakonomics; Dave “Davos” Nolan, a hedge fund billionaire; and senior figures from Morgan Stanley, Deutsche Bank, and Goldman Sachs. In the somber days after 9/11, it was inspiring to see the private sector respond to requests for help. Hundreds of calls went out for expert advice, and no one ever refused. There was an awkward moment when one Wall Street CEO asked if he could travel to the CIA by private helicopter and land on the grounds at Langley, but he was politely informed this would not be possible.
The red team was given a terror scenario and asked to think like terrorists and devise a way to trade on the inside information. We wanted to anticipate which markets they would trade in, how long before the attack they would execute the trades, the size they would trade, and how they planned to get away with the money. All this real-world expertise would be lined up against the theoretical results of Project Prophesy to see if we were on the right track and whether our proposed systems could catch what our designated bad guys were actually plotting.
The assignments and plans were handled individually outside the agency like a take-home exam. The results were debriefed in a group session at CIA headquarters on a crisp day in late September 2003. The debriefing lasted all day. The investment mavens relished their chance to be bad guys and attack our models and assumptions.
The most out-of-the-box approach came from John Mulheren. He said he would not trade before the attack but would wait until the moment of the attack and begin his insider trading after . He knew markets can be slow to react and that breaking news is often misreported or sketchy. This produces a window of thirty minutes or so after the attack when the terrorist could engage in insider trading while markets struggled to comprehend events taking place around them. The beauty of trading after the attack was there would be no telltale tape. Authorities might not even investigate that part of the time line. This approach closely mirrored what Mulheren had actually done on 9/11, as he later told us.
Notwithstanding such creativity, the actions of the red team “terrorists” tended to confirm the Prophesy team’s own thinking regarding how real terrorists would behave. We had modeled terrorist trading from start to finish, anticipating that the insider traders would be not the terrorists themselves but rather members of the terrorist social network. We also concluded the insider trade was likely to be executed in the options market less than seventy-two hours before the attack to minimize risk of detection.
We conceived an alarm system, too, compiling a list of the four hundred most likely target stocks. Baseline stock behavior was programmed so that anomalies were well defined. We created an automated threat board interface that broke the markets into sectors and displayed tickers with red, amber, and green lights, indicating the probability of insider trading. The system was complete, from the terrorist order entry to agents breaking down the terrorist’s door with a warrant in hand.
By late 2003, we were nearing the end of the strategic study. It was a bit melancholy because our Wall Street brain trust would be breaking up. Due to the number of people involved and the degree of talent, it seemed unlikely there would be any such group assembling at the CIA for some time to come. The complete records of the red team exercise were compiled and added to our main Project Prophesy archives.
Our job wasn’t quite finished, as by early 2004, Project Prophesy was ready to build a prototype watch center. When integrated with other classified sources, the system, ideally, would have the capability of interpreting, say, a scrap of pocket litter picked up from a suspected terrorist in Pakistan. The words cruise ship scrawled on it would be integrated with a red signal from the watch center on a public company such as Carnival Cruise Lines to bolster the case for a planned attack on a Carnival vessel. Either clue is revealing, but the combination is exponentially more telling.
We found our project’s angel investor in one of the more unusual corners of the CIA’s universe. A firm called In-Q-Tel had been organized in 1999 to allow the CIA to tap into cutting-edge technology incubated in start-ups in Silicon Valley. There’s no faster way to be on the inside of innovation than to show up with a checkbook ready to back the next big thing. In-Q-Tel was conceived as an independent, early-stage venture capital firm—which just happened to be funded by the CIA.
With In-Q-Tel funding a scaled-down team, Project Prophesy formally ended, and our group launched into a new phase called MARKINT, for market intelligence. This was a new branch of intelligence gathering to go along with human intelligence (HUMINT), signals intelligence (SIGINT), and a short list of other - INT s. MARKINT was a new milestone in the long history of intelligence collections.
Over the course of 2004 and 2005, the team refined its behavioral models and created the code and network needed for a working prototype. In addition to the CIA’s Randy Tauss, our partners were Lenny Raymond, a visionary technologist, and Chris Ray, a brilliant applied mathematician and causal inference theorist.
My role was to provide the market expertise, behavioral modeling, and target selection. Chris designed the algorithms and the signal engine. Lenny would weave it all together with a cool user interface. Randy ran the traps inside the agency and made sure we got funding and support. Together we had our own capital markets skunk works, after the famous black site in California where highly classified spy planes were designed and built. By early 2006, the system was running, and signals started coming in.
The system performed beyond our expectations. We routinely picked up signals that indicated insider trading. These signals were from regular market players; there was nothing yet to indicate that the insider trading was terror related. Our project had no legal enforcement powers, so we simply referred these cases to the SEC and otherwise ignored them. We called this our catch-and-release policy. We were hunting terrorists and would leave ordinary Wall Street crooks to others.
On Monday, August 7, 2006, the system flashed red on American Airlines at the open of trading. A red light was a way to spot a signal in a sea of sectors on the threat board. The metrics behind the signal showed this one was extremely powerful, something like an 8.0 earthquake on the Richter scale. A quick scan of the news showed absolutely nothing on American Airlines. There was no reason for the stock to behave the way it was—a sure sign of insider trading on news not yet public.
Chris Ray was operating the signal engine that day and sent me an e-mail that said, “There’s a possible terrorist-related event today. We did get a red signal on the open in AMR (American Airlines).” Chris and I were careful to document and time-stamp the signals and analyses in real time. We both knew that if a terror event occurred, it would not be very credible to look at the tape in hindsight and find something suggestive. We wanted to see things in advance and record them to prove the value of the signal engine.
Читать дальше