DDoS attacks have been confirmed that have taken down two credit unions and several large banks' websites. It's been proven our entire financial system is vulnerable. While stealing personal information doesn't seem to have been at play, this is a critical concern for the entire financial services industry. The two confirmed, targeted credit unions were able to get their sites back up in a few hours, which is excellent news.

Consider for a moment if these attacks had not been one offs, but a coordinated and concerted effort to take down the U.S.—or even global—banking system. It's not difficult to imagine, raising grave safety and soundness and national security concerns.

If this sounds far-fetched, you're wrong. In 2007 the Estonian government was forced to shut down all access to government websites from IP addresses outside of Estonia when rioting spread from the streets to the virtual highway, according to arstechnica.com. Estonia claimed that the DDoS attack came from Russian government IP addresses.

The New York Times website was reportedly attacked by the Chinese government for a period of four months, and it has allegedly gone after other news sites reporting negative news about that government.

Cyber warfare with countries, like Iran, where the group taking credit for the DDoS attacks on the credit unions are from, wouldn't be bloody but it could be costly, which could turn bloody.

Meanwhile the Federal Financial Institutions Examination Council is dilly-dallying with consumer disclosures in social media. This is heart-stoppingly out of touch considering the recent cyber attacks.

I will state upfront that I have no idea what a DDoS attack really is or how to prevent one or repairs needed after the fact. I do recognize the need to address this matter promptly as opposed to making sure CD account offerings via Twitter have proper TISA disclosures and include the appropriate federal deposit insurance logos.

Suppose the targeted credit unions were not billion-dollar institutions, but instead hundreds or thousands of credit unions or banks with less than $100 million in assets that might not have been as well prepared and resourced. Imagine millions of depositors and lenders unable to access their accounts online from various institutions across the nation and the world for hours or even days at once.

The result: Loss of confidence in the banking system and particularly in the virtual world.

Part 748.1 of the NCUA regs states: “Catastrophic act report. Each federally insured credit union will notify the regional director within five business days of any catastrophic act that occurs at its office(s). A catastrophic act is any disaster, natural or otherwise, resulting in physical destruction or damage to the credit union or causing an interruption in vital member services…projected to last more than two consecutive business days. Within a reasonable time after a catastrophic act occurs, the credit union shall ensure that a record of the incident is prepared and filed at its main office.”

The breach has to last two days before it's significant, and even then credit unions are given five days to report it. An unbelievable amount of damage could be wrought in that amount of time regarding reputational and other types of risk that pack a punch to safety and soundness.

But instead of addressing this primary security issue, the regulators want to make sure financial institutions' Facebook pages include TILA disclosures and don't violate UDAP.

No, consumer protection is the focus of the administration in spite of what's going on. Legislation was introduced to allow students relief in bankruptcy proceedings for student loan debt. Senator Durbin assailed private student lenders as the government's student loan portfolio is deteriorating, which Bloomberg reported.

And Fannie Mae and Freddie Mac, which fueled the flames in the housing crisis, want to allow principal forgiveness on certain mortgages.

Michigan First FCU CEO Michael Poulos responded to the news, that, “Aside from bankruptcy, which is adjudicated within strict legal guidelines and is subject to legal challenges from all the parties (particularly lenders), there has never been any aspect of the borrowing process whereby a borrower could simply claim a certain life circumstance and be relieved of a debt obligation.” He continued that such a move would negatively impact loan pricing and dry up credit.

To be able to do this, they likely will have to charge lenders a premium. When the lenders' costs go up, they make up the difference from their borrowers. The government is simply taking a slice as the middleman.

If this administration is truly concerned about consumer protection, stop the DDoS attacks. That will provide consumers greater peace of mind than adding more disclosures and costs to already cumbersome financial transaction processes.

Instant Insights /

Quit Messing With Social Media, Stop DDoS Attacks: Editor/Publisher's Column

Related Stories

Recommended For You