FBI Finds Holes in System Protecting Economic Data

Law-enforcement officials found "a number of operational vulnerabilities" involving "black boxes" used by several departments to control the release of sensitive economic data such as the monthly unemployment rate, according to a report by the inspector general at the Commerce Department.

The report said it was possible to subvert the system, which was designed to prevent media companies from sending economic data to traders early.

The report, which was reviewed by The Wall Street Journal, is part of a broad law-enforcement inquiry into whether media firms or any of their employees are sending government data to traders before the agreed-upon embargoes expire, which could violate insider-trading laws.

The FBI has long been concerned about what investigators view as suspicious trading activity that occurs just before some government releases of sensitive economic data, according to people familiar with the investigation. Federal agents have spent years trying to determine if that activity is due to misconduct during the formal release period, which is known as a lockup.

The black boxes are key to the government's control of the data. Media firms in the business of reporting economic data are required to connect their computers to the black boxes, which operate like a trapdoor, releasing articles and data streams when the embargoes lift. In theory, all the data should be released at the same time.

The investigative report, which was completed in May and obtained through an open-records request, indicates that the FBI's concerns are based on testing of black boxes at its Quantico, Va. facilities. The report didn't say whether the FBI knows of any specific instance in which anyone knowingly exploited the weaknesses. Many of the technical flaws involve different ways in which the black boxes can be bypassed.

The report focused primarily on a short-lived probe of Bloomberg L.P., which was exonerated of any wrongdoing. The Bloomberg issue began in May 2012 when the media firm installed new devices in the Commerce Department to speed up delivery of data to subscribers, according to the Commerce report.

In its own testing, Bloomberg found it could get around the black box in several ways, such as sending data using different electrical current.

Bloomberg reported the flaws to the Commerce Department last summer and didn't use the devices in any data releases, Bloomberg told investigators, according to the report. After Bloomberg alerted the department, the FBI conducted a "consensual seizure" of its computers for testing.

The inspector general at the Commerce Department found "no evidence of an intentional violation" of the law by Bloomberg or its reporters, according to the report. In October, the FBI informed the Justice Department it found "no evidence of any embargo violation(s)" and the case was closed.

Ty Trippet, a spokesman for Bloomberg, said the conclusion "validates what we've said all along: We discovered a technical flaw in the Commerce Department's lock-up security protocols during a testing period sponsored by the department."

Dow Jones, the publisher of the Journal, is one of several media firms that feed the government's economic data to trading clients. In a statement, the company said it "always endeavors to follow all lockup procedures and rules, and would never sanction-and is not aware of-any intentional violations."

The FBI's testing led it to discover other methods to get around the black boxes in ways that could "adversely impact the timed release of sensitive economic data," according to the report.

For one, media firms, if unobserved, could simply turn off the power on the black boxes, the FBI cautioned. Data also could be surreptitiously routed around the black boxes using concealed wireless devices or even a phone line or cable.

Such "concealed IT devices may still be in use" in lockup rooms across the government, according to a summary of the investigative report.

The fact that these devices could be "concealed to intentionally disguise their presence...should be made known to the proper personnel," the FBI said, according to the report.

In November, law-enforcement officials relayed the concerns to officials at the Departments of Commerce, Agriculture and Labor, as well as the Federal Reserve Board and the Office of Management and Budget. Officials at those departments either didn't respond to requests for comment or declined to comment.