Matt Levine is a Bloomberg Opinion columnist covering finance. He was an editor of Dealbreaker, an investment banker at Goldman Sachs, a mergers and acquisitions lawyer at Wachtell, Lipton, Rosen & Katz, and a clerk for the U.S. Court of Appeals for the 3rd Circuit. Read more opinion SHARE THIS ARTICLE Share Tweet Post Email

Hey look, they caught the guy who caused the flash crash of 2010! His name is Navinder Singh Sarao, and he lives in London and in 2009 he asked someone to help him build a spoofing robot:

On or about June 12, 2009, SARAO sent an email to a representative of his FCM in which he explained that he "need[ed] to get in touch with a [] technician [at the company that provided his trading software ("Trading Software Company #1")] that will be able to programme for me extra features on [the software]," namely, "a cancel if close function, so that an order is canceled if the market gets close."

Sarao was trading E-mini S&P 500 futures contracts, but he wanted a more convenient way to not trade them, so he e-mailed his FCM (futures commission merchant, i.e. broker) for help automating that. The idea is that he would put in a big order to sell a whole bunch of futures at a price a few ticks higher than the best offer. So probably he wouldn't sell any futures, since he wasn't offering the best price. But he had to keep constantly updating his orders to keep them a few ticks higher than the best offer, to make sure that he didn't accidentally sell any futures as the market moved. And that's a bit of a pain, so he programmed an algorithm to do it for him. Though he also seems to have done similar things manually, to support the algorithm's efforts, or to stave off boredom while the algorithm did its thing.

The point of this -- according to the federal prosecutors, the Federal Bureau of Investigation and the Commodity Futures Trading Commission, who are not happy with Sarao -- is that by placing all these fake sell orders, Sarao would artificially drive down the price of the E-mini futures. It's classic spoofing: He'd place a lot of big orders to sell, everyone else would say, "Ooh look at all those big sell orders, I'd better sell too," they'd sell, the market would go down, he'd buy, he'd turn off his algorithm, everyone else would say, "Oh hey never mind, things are great again, there are no more big sell orders," they'd buy, the price would go back up, and Sarao would sell the futures he'd bought at a lower price a moment ago. We've talked about spoofing before, and I've always been a little troubled that it works, but what can I say, it works.

On May 6, 2010, according to the authorities, it worked a little too well: Sarao did such a good job of driving down the price of the E-mini future that he caused a flash crash in which "investors saw nearly $1 trillion of value erased from U.S. stocks in just minutes." I'll put some more details downstairs but honestly they are boring details. Sarao traded a ton of E-mini futures during the flash crash -- "62,077 E-mini S&P contracts with a notional value of $3.5 billion" -- and made "approximately $879,018 in net profits" that day, or a profit of about 2.5 basis points on the notional amount, which I guess isn't bad for one day's work. He did this by, basically, putting in orders to sell thousands of contracts away from the best offer. Those orders were never executed, or intended to be executed, but they tricked people into thinking that there was a lot more selling interest than there actually was. That combined with a collapse in buying interest -- at one point Sarao's fake sell orders alone "were almost equal to the entire buyside of the Order Book" -- to create a collapse in prices. He profited from those collapsing prices by selling high and buying back lower. It's a pretty straightforward spoofing story.

So straightforward that one of the biggest puzzles here is why it took so long -- and the help of a whistleblower -- for regulators to figure it out. They came tantalizingly close:

As reflected in correspondence with both SARAO and an FCM he used, the CME observed that, between September 2008 and October 2009, SARAO had engaged in pre-opening activity -- specifically, entering orders and then canceling them -- that "appeared to have a significant impact on the Indicative Opening Price." The CME contacted SARAO about this activity in March 2009 and notified him, via correspondence dated May 6, 2010, that "all orders entered on Globex during the pre-opening are expected to be entered in good faith for the purpose of executing bona fide transactions." The CME provided a copy of the latter correspondence to SARAO's FCM, which suggested to SARAO in an email that he call the FCM's compliance department if he had any questions. In a responsive email dated May 25, 2010, SARAO wrote to his FCM that he had "just called" the CME "and told em to kiss my ass."

Emphasis added because come on: The futures exchange wrote to Sarao on the day of the flash crash, telling him to stop spoofing, and he called them back "and told em to kiss my ass." And then regulators pondered that reply for five years before deciding that they'd prefer to have him arrested in London and extradited to face criminal spoofing charges. One conclusion here might be that rudeness to regulators really works.

Even odder, Sarao didn't just retire to a supervillain lair after the flash crash. The CFTC lists "at least" 12 days on which he allegedly manipulated the futures market; eight of them came after the flash crash, and he allegedly continued to manipulate the futures market more or less up to the moment he was arrested. The CFTC claims that Sarao basically started his spoofing career by causing the flash crash, and then went ahead and kept spoofing for another five years without much interruption. I guess he got more subtle at it? Not very subtle though; he was a consistently large trader, "placing, repeatedly modifying, and ultimately canceling multiple 200-, 250-, 300-, 400-, 500-, 550-, 600-, and 900-lot sell orders," versus an average order size of seven contracts. He also seems to have had some patterns (like putting in orders for exactly 188 or 289 contracts that never executed) that you'd think would make him easier for regulators or exchanges to spot. If regulators think that Sarao's behavior on May 6, 2010, caused the flash crash, and if they think he continued that behavior for much of the subsequent five years, and if that behavior was screamingly obvious, maybe they should have stopped him a little earlier?

Also, I mean, if his behavior on May 6, 2010, caused the flash crash, and if he continued it for much of the subsequent five years, why didn't he cause, you know, a dozen flash crashes?

So I mean ... maybe he didn't cause the flash crash? There's a joint CFTC and Securities and Exchange Commission report that came out a few months after the flash crash that blames it on an effort by Waddell & Reed to sell some E-mini futures with an inept algorithm; lots of people have long had their doubts about that theory, and now the CFTC itself seems to have abandoned it in favor of the new one-guy-in-London theory. You could maintain a skeptical attitude about the one-guy-in-London theory too though. The CFTC says that Sarao's "Layering Algorithm" was turned on between 11:17 a.m. and 1:40 p.m. Central time, and that "the Layering Algorithm caused the price in the E-mini S&P contract to be temporarily artificially depressed while the Layering Algorithm was active. Once the Layering Algorithm was turned off and the orders were canceled, the market price typically rebounded." But the CFTC also describes the flash crash this way:

Between 1:41 and 1:44 p.m. CT, the E-mini S&P market price suffered a sharp decline of 3%. Then, at 1:45 p.m. CT, in a matter of 15 seconds, the E-mini S&P market price declined another 1.7%. The price crash in the E-mini S&P market quickly spread to major U.S. equities indices which suffered precipitous declines in value of approximately 5 to 6%, with some individual equities suffering much larger declines.

Get that? The flash crash happened when Sarao's algorithm had been turned off, and the price should have been rebounding :

I mean, look, he probably didn't help. The markets were nervous, and his spoof orders probably made them more nervous. One intriguing theory is that his orders interacted badly with Waddell & Reed's algorithm: Perhaps Waddell sold its futures too quickly because its algorithm thought that there was a lot of selling pressure behind it. But Sarao, according to the CFTC, was 20-29 percent of the sell-side pressure at his peak, and almost none of his orders executed. Other people provided the other 71-80 percent of the sell orders, and at least some of their orders executed, causing prices to actually go down. It seems unlikely that Sarao's not trading caused the whole crash. And, to be fair, the authorities say that Sarao's "manipulative activities contributed to an extreme E-mini S&P order book imbalance that contributed to market conditions that led to the Flash Crash," rather than coming out and saying that the crash was his fault. At the very least, though, he picked the wrong day to do billions of dollars worth of spoofing.

It's worth keeping the notions of "spoofing" and "high-frequency trading" carefully separated. Sarao may have been a spoofer, but he doesn't seem to have been doing the sort of high-speed algorithmic trading that usually qualifies as "HFT." He himself claimed to be "'an old school point and click prop trader' who had 'always been good with reflexes and doing things quick,'" and the "Layering Algorithm" that he used was a customized version of "a program that allowed non-programmers to engage in automated trading using spreadsheet commands and functions." He was also the sole owner and employee of his trading firm, which he "operated from his residence." In style and substance he is not all that different from other spoofers we have known and loved, who did their high-speed trading by just punching keys really fast.

I have always been impressed and puzzled that low-tech spoofers have much success ripping off whomever they rip off. It's such a minimal fraud; it's just saying that you want to sell when you don't want to sell. It's always surprising that that could have a major effect on markets. John Arnold has argued here at Bloomberg View that spoofing only hurts front-running high-frequency traders, while others point out that "algorithmic trading tools are used by a wide class of traders," including long-term investors like Waddell & Reed who use algorithms to try to avoid the front-running HFTs. But the FBI's and CFTC's theory here is far more troubling: It suggests that existing algorithms are not just dumb enough to give spoofers some of their money, but dumb enough to give spoofers so much of their money that they destabilize the financial markets. It's not especially confidence-inspiring to read that a guy with a spreadsheet can trick everyone into thinking that the market is crashing, and thereby cause the market to crash.

From DealBook today: The arrest casts a harsh light on the original explanation for the crash, which appears to have been completely wrong. After the flash crash, the Securities and Exchange Commission and the Commodity Futures Trading Commission produced a report that laid the blame on one trade from Waddell & Reed, a brokerage firm based in Kansas City, Mo. A Dutch academic later challenged that view, saying the answer was more complex.

This column does not necessarily reflect the opinion of Bloomberg View's editorial board or Bloomberg LP, its owners and investors.

To contact the author on this story:

Matt Levine at mlevine51@bloomberg.net

To contact the editor on this story:

Zara Kessler at zkessler@bloomberg.net