Online investors take hacker fest in stride

All the years and all the money online brokers have spent gaining investor trust was tested in one computer keystroke.

The cyberassault on E*Trade Group Inc., which has two million brokerage accounts, is giving this industry pause, no matter how much it protests.

E*Trade, the No. 2 online broker, was hit on the third day of coordinated attacks on some of the web’s most popular destinations. Earlier, the hackers had confined themselves to e-commerce sites like Amazon.com and eBay, news gatherer CNN and Internet search engine Yahoo! Inc.

“Online brokerages are probably more at risk than other companies,” says Alan Alper, an analyst with Boston’s Gomez Advisors, about what are being called denial-of-service attacks. “Their clients need to access their accounts at very specific times.”

Gomez estimates that within 90 minutes, 38% of the users who wanted to get onto E*Trade couldn’t because the hackers had filled it to capacity with empty mail and the like.

The bad news for investors is that they should expect more of the same.

The more people who find their way onto the Internet brings richer hunting grounds for hackers.

Of course, hackers aren’t the only thing getting in the way of timely stock trading; it’s still unclear if the Internet can even accommodate everyone who wants to come on.

The silver lining to this black cloud is that the past week’s cyber-hooliganism taught businesses an important lesson in monitoring use.

“Hackers are limited by bandwidth and companies can filter out denial of service attacks faster than the Internet can deliver them,” says Steve Hunt, a securities analyst with Giga Group, a consultancy in Cambridge, Mass.

Though no client accounts or assets were tampered with at E*Trade — hackers simply flooded the web sites with tons of hits, preventing others from getting access — let the client beware.

“This is a standard business decision that the individual investor has to make,” Mr. Hunt says. ” `Am I willing to accept a certain degree of unreliability?’ And if the answer is yes, then by all means go ahead and trade online.”

E*Trade did not return repeated calls for comment. But TD Waterhouse and Charles Schwab Corp. say that there are other ways to invest with them if the Internet fails.

“Because of our clicks and bricks strategy, clients have other alternatives such as through the branches,” says Jill Totenberg, a Waterhouse spokeswoman in New York.

San Francisco-based Schwab, the largest online brokerage firm with 62 million on-line accounts, declined to provide details about what the company is doing to prevent similar attacks. “Obviously talking about it would defeat the purpose of the security,” says Glen Mathison, company spokesman. “We don’t want to be in a position of daring anyone to hack our site.”

smaller is better

Michael Anderson, vice president of investor relations for Ameritrade Holdings Inc. of Omaha, Neb., the No. 5 online broker with 686,000 accounts, says that it may have been spared because of its size. “We’re not as big as some of the others. This time it was a blessing,” he says.

The market clearly wasn’t concerned about the hour-and-a-half defect. Stock prices of publicly traded online brokerages were mixed.

E*Trade ended Thursday’s session at $22, up 12? cents; Schwab closed at $38.50, up 75 cents, and Ameritrade closed at $16.125, down a quarter.

Experts like Mr. Hunt believe that hackers may have tried to get into other online brokerages but only succeeded with E*Trade.

Those who follow the industry say investors have to take the problems in stride. Even without hacking, the Internet is fraught with frustrations, particularly when too many people try to get online at once.

Moments after Kenneth Starr’s report on the White House sex scandal was released online in 1998, for instance, millions of Internet users flocked to the site. Latecomers were shut out.

And users routinely have problems logging onto Internet service providers at peak times, such as in the evenings when people return home from work and surf the web.

But a brokerage account isn’t the same as reading a lurid account of the president’s trysts or checking e-mail. Active traders trying to act on a certain price can suffer.

“If I want to buy IBM at $110 and I can’t get on the web because some hacker has swamped the website, and it’s 4: 01 when they pick up the phone, that’s tough noogies for me,” says Richard Bregman, principal of MJB Asset Management in New York.

The attacks illustrate the limitations of living in a virtual world. “When the web is your only channel, you are hosed,” says Jaime Punishill, analyst with Forrester Research of Boston.

Wayne Wagner, president of Los Angeles-based Plexus Group, which monitors efficient trading, likens the problems at E*Trade to Black Monday in October 1987 when the market fell 508 points and phone lines became clogged with investors calling their brokers.

“The system was swamped,” Mr. Wagner recalls. “The tape was two hours behind, and no one knew if the price they saw on their screens was the price they were getting.”

Because computer users have come to expect difficulty, it isn’t surprising that some treated the cyber vandalism at E*Trade with a yawn. “Schwab’s trading system goes down quite a bit,” says Bob Markman, a planner in Minneapolis. “We’re not trading on a minute-to-minute basis.”