Big Banks Seek Control of Instant Messaging in an Insecure World

  • Receiving Wide Coverage ...UBS Settlement: The Swiss bank is negotiating a deal with international regulators in which it will pay $1 billion in fines for manipulating Libor, the papers report. UBS' Japanese unit will enter a guilty plea to a criminal charge, the first such capitulation by a bank in over a decade, according to the New York Times. "Federal prosecutors are trying to strike a balance," the paper says. "By levying a charge against the subsidiary, authorities send a powerful message, but stop far short of putting the company out of business" — a known hazard of indicting corporations for the actions of individual employees (see: Arthur Andersen). Wall Street Journal, Financial Times, New York Times

    December 14
  • An RSA cybercrime expert walks us through a typical online/mobile banking attack with a new twist: an SMS forwarder that steals authentication codes.

    June 10
  • The industry has moved from a traditional customer-oriented banking model to a transactional and counterparty-oriented model. This change has contributed to an operating environment in which the opportunity for abuse and deception has increased.

    December 16

Three years after the publication of salty and incriminating instant messages between traders in the Libor-rigging scandal embarrassed the financial industry, large banks are taking control of their electronic communications.

This week 14 giant banks and broker-dealers including Goldman Sachs formed a holding company called Symphony Communications and acquired Perzo, a secure-messaging startup, for $66 million. Many of the investors are expected to be early adopters of the technology. Backers like Darren Cohen, a global co-head of principal strategic investments at Goldman, cited "the strong desire for a more open, secure, compliant and efficient communication platform."

The acquisition comes at a time of heightened concerns about cybersecurity, as data breaches and revelations of government and corporate snooping have consumers and businesses alike reevaluating their trust in third parties to safely store sensitive information.

Wall Street is no exception. About a year ago, investment bankers expressed dismay that popular instant messaging services like Bloomberg and Pivot were screen-scraping their instant messaging systems for information about stock prices. And storing employee communications with a third party can compound compliance problems, if investigators find evidence of misconduct before a bank's own executives and lawyers do.

"There's a very real liability and risk to using instant messaging," said David Weiss, senior analyst at Aite Group. "Imagine you're general counsel of a big global firm and tomorrow you come into work and you're met by press and the Department of Justice and they've handed down an indictment. Is that not the worst day of your life? That's what happens with a hosted environment."

Symphony promises to give these firms more control over their employees' communications, and not only because they own the venture.

"We built a technology with multiple layers of security to show we provide the utmost protection for our customers' data, and that we'll never be in a position to own their data," said David Gurle, Perzo's founder and CEO, who remains in charge of the business.

The security includes encryption at the end-user level. Each message is encrypted with a different key, so if somebody were to intercept a message they'd have difficulty reading it.

Messages are sent using the https protocol, and when data arrives at the bank's data center, the software encrypts the message yet again.

The encryption keys will not be stored at Symphony, and this is likely a big selling point for secretive Wall Street firms (the same is true of Markit's messaging service). Rather, the keys will be stored on the user's device or in a company vault. While they're hidden from the service provider, they can be found by a bank's internal compliance officers, Gurle said.

"What [the big banks are] really concerned about is being compliant with regulations," Gurle said. 

Goldman Sachs previously tried to build its own instant messaging system, Live Current. The investment bank did not immediately respond to questions about that project, which will now be integrated with the Perzo software.

"The truth is, large financial firms, compared to the real world and au courant software development, are bad at it," Weiss said. "Institutionally that's not what they're about."

The large banks also may be seeking to loosen Bloomberg LP's grip on trader messages. "The thing that bugs banks the most is with Bloomberg is there's no negotiating," Weiss observed. Bloomberg did not immediately respond to a request for comment.

And they may want a messaging platform that can be used beyond the trading desks. Perzo and Markit offer a kind of "hyper secure messaging for the rest of us," Weiss said. Normally, banks don't invest in expensive messaging services for less-profitable departments.

In the Libor rate-fixing episode, the evidence investigators found in traders' emails and chat messages have helped indict several banks. Barclays and UBS have already paid large fines as a result of the regulatory investigation. Here's one of the cleaner exchanges that have been made public:

Swiss Franc Trader: can u put 6m swiss libor in low pls?

Primary Submitter: NO

Swiss Franc Trader: should have pushed the door harder

Primary Submitter: What's it worth

Swiss Franc Trader: ive got some sushi rolls from yesterday?

Primary Submitter: ok low 6m , just for u

Aside from Goldman, the investors in Symphony are Bank of America Merrill Lynch, BNY Mellon, BlackRock, Citadel, Citi, Credit Suisse, Deutsche Bank, Jefferies, JPMorgan, Maverick, Morgan Stanley, Nomura and Wells Fargo.

The Perzo system, which is based on open source software, aims to support text, email and social media messages, as well as workflow tools.

Where messaging systems fall short, according to Gurle, is that they just do messaging.

"Messaging is not a separate conduit in your brain," he said. "Your brain works in different ways than the software. You're constantly switching contexts. It's like having hot and cold water pipes that never mix with each other. You need to have messaging along with the information you care about in the same workflow tool so you can send structured and unstructured messages in real time and share things that make that exchange of information valuable."

Gurle worked at Skype, Microsoft and Thomson Reuters — all purveyors of messaging technology — for about 20 years. He founded Perzo in 2012. "I'd always looked at the messaging space from a real time messaging perspective but there's a whole world around email, file sharing and social networking that are parts of our everyday lives," he said. "The idea of Perzo was taking these two ideas and making them one, so that you have one application for any mode of communication."

Key to Perzo's success will be its ability to create a network effect the way Bloomberg has done. In other words, get enough of the right people using it so that everyone will want it. And getting the details right, so the messaging and security work as promised.

For reprint and licensing requests for this article, click here.
Bank technology
MORE FROM AMERICAN BANKER