Tuesday, April 23rd, 2013

A photograph taken from the back of an old single-screen movie theater during a weekday matinee, looking down over rows of deep magenta velvet seats toward the screen. The picture has just come back on after a brief interruption: the tall screen glows a soft blank white, washing pale light over the front rows. The audience is resettling — most already seated again, a few still half-risen mid-return, one reaching for a dropped coat — heads silhouetted against the glow. An usher with a small flashlight, its beam low on the carpet, walks back up the side aisle. Standing behind the last row in the center aisle, seen from behind, is a man in full clown makeup and a grey suit a half size too big — tidy lavender side-parted hair — perfectly still, facing the glowing blank screen, his hands clasped behind his back holding a small brown paper bag. Not one member of the audience turns around.

The flash that wasn't

S&P 500 1,578.78 · +16.28 · +1.04%

At 1:07 the algorithms saw an explosion. At 1:10 the building was visibly intact. The tape closed green and kept almost no evidence.

The photograph Retail at the Matinee

The day's protagonist

The headline that wasn't — no symbol.

Move: One hacked tweet at 1:07 p.m.; $136 billion out and back inside three minutes

At 1:07 p.m. the Associated Press's hacked account posted a single sentence: two explosions at the White House, the president injured. The algorithms that read news faster than any human sold first and verified never — the Dow shed roughly a hundred and forty points in under three minutes, a hundred and thirty-six billion dollars of index value gone on the word of a stolen password. By 1:10 the White House was observably not on fire; the press secretary said so from inside it; AP disavowed the account. The market returned to precisely where it had been, closed up one percent on honest earnings, and the episode entered the language as the hash crash. The Syrian Electronic Army claimed the tweet. The vulnerability it advertised was never patched, because it is not in the software.

The deeper account

The house records documented closes, and the closes deny the whole event: low 1562.50 — the open, not the crater. The strangest fact of the page is that its own data cannot see the thing it commemorates.

The machines that sold at 1:07 were doing what they were sold to do: parse headlines faster than rivals. Speed-reading has no organ for doubt.

Three pages of this wing now share a mechanism — the Flash Crash, Knight, and this — and the interval keeps shrinking: thirty-six minutes, forty-five minutes, three.

AP's newsroom, hacked mid-afternoon, spent the evening reporting accurately on itself. The wire that moved the market corrected the market.

After this day the SEC blessed corporate disclosure via social media and every trading floor bought tweet-verification software. The lesson stuck for almost exactly as long as such lessons do.

The artifact

BOOTH · TUESDAY MATINEE · APR 23 INCIDENT CARD 1:07 picture lost. a report of fire — sixty-odd characters, from a stolen account. 1:08 the fast readers sold first. about $136 billion out. 1:10 no fire. the building said so itself, from inside. 1:13 picture restored. frame-exact. THE REEL closed up one, on honest earnings. NOTHING ON THE NEGATIVE CAUSE: A STOLEN PASSWORD THE FAULT IS NOT IN THE PROJECTOR
The projectionist's incident card — filed in the booth, under the spare bulb

Six minutes, card-complete: the sentence at 1:07, the selling at 1:08, the visibly intact building at 1:10, the frame-exact restore at 1:13. The stamp is the day's verdict and its warning in five words — the record kept no scar, which is precisely why the vulnerability was never patched. It is not in the software.

Read the incident card

Printed text is shown plain; handwritten entries are shown in script.

BOOTH · TUESDAY MATINEE · APR 23 · INCIDENT CARD

  • 1:07 — picture lost. a report of fire — sixty-odd characters, from a stolen account.
  • 1:08 — the fast readers sold first. about $136 billion out.
  • 1:10 — no fire. the building said so itself, from inside.
  • 1:13 — picture restored. frame-exact.
  • THE REEL: closed up one, on honest earnings.
  • NOTHING ON THE NEGATIVE  CAUSE: A STOLEN PASSWORD · THE FAULT IS NOT IN THE PROJECTOR

At 1:07 p.m. the Associated Press's hacked account reported explosions at the White House. The Dow shed roughly 143 points in under three minutes — about $136.5 billion of S&P 500 value by the Reuters count — and had it all back by 1:13, once the White House was observably not on fire. The S&P 500 closed up 1.04 percent at 1,578.78 on honest earnings. The Syrian Electronic Army claimed the sentence; the day entered the language as the hash crash.

The ledger — what actually happened

Measure Close Change Marginalia
S&P 500 1,578.78 +16.28 · +1.04% a good earnings day, interrupted for three minutes
Dow Jones 14,719.46 +152.29 · +1.05% about 143 points down at 1:08; all of it back by 1:13
The crater ≈ $136.5 billion S&P 500 value briefly erased, by the Reuters count — on sixty-odd characters of fiction
The author a stolen password AP's account, hacked; the Syrian Electronic Army claimed the sentence

Sources

  1. The Washington Post — Market quavers after fake AP tweet — https://www.washingtonpost.com/business/economy/market-quavers-after-fake-ap-tweet-says-obama-was-hurt-in-white-house-explosions/2013/04/23/d96d2dc6-ac4d-11e2-a8b9-2a63d75b5459_story.html
  2. CNBC — False Rumor of Explosion at White House Causes Stocks to Briefly Plunge — https://www.cnbc.com/2013/04/23/false-rumor-of-explosion-at-white-house-causes-stocks-to-briefly-plunge-ap-confirms-its-twitter-feed-was-hacked.html
  3. NBC News — AP Twitter Hijack Leads to Stock-Market Plunge — https://www.nbcnews.com/news/amp/wbna51635713
  4. Public record — Reuters estimate: ≈$136.5B in S&P 500 value briefly erased; the 'hash crash'