Hey look, they caught the guy who caused the flash crash of 2010! His name is Navinder Singh Sarao, and he lives in London and in 2009 he asked someone to help him build a spoofing robot:
On or about June 12, 2009, SARAO sent an email to a representative of his FCM in which he explained that he "need[ed] to get in touch with a [] technician [at the company that provided his trading software ("Trading Software Company #1")] that will be able to programme for me extra features on [the software]," namely, "a cancel if close function, so that an order is canceled if the market gets close."
Sarao was trading E-mini S&P 500 futures contracts, but he wanted a more convenient way to "not to trade them", so he e-mailed his FCM (futures commission merchant, i.e. broker) for help automating that. The idea is that he would put in a big order to sell a whole bunch of futures at a price a few ticks higher than the best offer. So probably he wouldn't sell any futures, since he wasn't offering the best price. But he had to keep constantly updating his orders to keep them a few ticks higher than the best offer, to make sure that he didn't accidentally sell any futures as the market moved. And that's a bit of a pain, so he programmed an algorithm to do it for him. Though he also seems to have done similar things manually, to support the algorithm's efforts, or to stave off boredom while the algorithm did its thing.
The point of this -- according to the federal prosecutors, the Federal Bureau of Investigation and the Commodity Futures Trading Commission, who are not happy with Sarao -- is that by placing all these fake sell orders, Sarao would artificially drive down the price of the E-mini futures. It's classic spoofing: He'd place a lot of big orders to sell, everyone else would say, "Ooh look at all those big sell orders, I'd better sell too," they'd sell, the market would go down, he'd buy, he'd turn off his algorithm, everyone else would say, "Oh hey never mind, things are great again, there are no more big sell orders," they'd buy, the price would go back up, and Sarao would sell the futures he'd bought at a lower price a moment ago. We've talked about spoofing before, and I've always been a little troubled that it works, but what can I say, it works.
On May 6, 2010, according to the authorities, it worked a little too well: Sarao did such a good job of driving down the price of the E-mini future that he caused a flash crash in which "investors saw nearly $1 trillion of value erased from U.S. stocks in just minutes."
I'll put some more details downstairs but honestly they are boring details. Sarao traded a ton of E-mini futures during the flash crash -- "62,077 E-mini S&P contracts with a notional value of $3.5 billion" -- and made "approximately $879,018 in net profits" that day, or a profit of about 2.5 basis points on the notional amount, which I guess isn't bad for one day's work. He did this by, basically, putting in orders to sell thousands of contracts away from the best offer. Those orders were never executed, or intended to be executed, but they tricked people into thinking that there was a lot more selling interest than there actually was. That combined with a collapse in buying interest -- at one point Sarao's fake sell orders alone "were almost equal to the entire buyside of the Order Book" -- to create a collapse in prices. He profited from those collapsing prices by selling high and buying back lower. It's a pretty straightforward spoofing story.
So straightforward that one of the biggest puzzles here is why it took so long -- and the help of a whistleblower -- for regulators to figure it out. They came tantalizingly close:
As reflected in correspondence with both SARAO and an FCM he used, the CME observed that, between September 2008 and October 2009, SARAO had engaged in pre-opening activity -- specifically, entering orders and then canceling them -- that "appeared to have a significant impact on the Indicative Opening Price." The CME contacted SARAO about this activity in March 2009 and notified him, via correspondence dated May 6, 2010, that "all orders entered on Globex during the pre-opening are expected to be entered in good faith for the purpose of executing bona fide transactions." The CME provided a copy of the latter correspondence to SARAO's FCM, which suggested to SARAO in an email that he call the FCM's compliance department if he had any questions. In a responsive email dated May 25, 2010, SARAO wrote to his FCM that he had "just called" the CME "and told em to kiss my ass."
Emphasis added because come on: The futures exchange wrote to Sarao on the day of the flash crash, telling him to stop spoofing, and he called them back "and told em to kiss my ass." And then regulators pondered that reply for five years before deciding that they'd prefer to have him arrested in London and extradited to face criminal spoofing charges. One conclusion here might be that rudeness to regulators really works.
Even odder, Sarao didn't just retire to a supervillain lair after the flash crash. The CFTC lists "at least" 12 days on which he allegedly manipulated the futures market; eight of them came after the flash crash, and he allegedly continued to manipulate the futures market more or less up to the moment he was arrested. 5 The CFTC claims that Sarao basically started his spoofing career by causing the flash crash, and then went ahead and kept spoofing for another five years without much interruption. I guess he got more subtle at it? Not very subtle though; he was a consistently large trader, "placing, repeatedly modifying, and ultimately canceling multiple 200-, 250-, 300-, 400-, 500-, 550-, 600-, and 900-lot sell orders," versus an average order size of seven contracts. He also seems to have had some patterns (like putting in orders for exactly 188 or 289 contracts that never executed) that you'd think would make him easier for regulators or exchanges to spot. If regulators think that Sarao's behavior on May 6, 2010, caused the flash crash, and if they think he continued that behavior for much of the subsequent five years, and if that behavior was screamingly obvious, maybe they should have stopped him a little earlier?
Also, I mean, if his behavior on May 6, 2010, caused the flash crash, and if he continued it for much of the subsequent five years, why didn't he cause, you know, a dozen flash crashes?