The Sphex and The Spoofer

The Passive Agressive Order Type

Some people claim that a passive order could not have caused the Flash Crash. While I certainly don't believe there is a single cause, I also do not believe that just because an order is passive means it can't drive down prices. A smart spoofing strategy can get a predictable algorithm to do some interesting things. But it isn't just computers that can be predictable, humans can be too. (I wouldn't be surprised to find human traders are more predictable than computers, but computers might be easier to target.) According to the CFTC and the Justice Department a guy trading futures from England was very predictable, placing orders of either 188 or 289 lots. That's like announcing to the world "Hi, it's me again the 188/289 guy. Pardon me, I'm just back to trade 10% of the market volume and take out my $500,000." (These are roughly what the CFTC alleges in its complaint). I'm kind of amazed just writing these words. I should point out that analyzing changes in order book data in incredibly difficult due to the volume of information and recently enough was beyond the capability of agencies such as the CFTC.

I do not know much about the logic of the passive sell order in place during the Flash Crash so nothing I say here refers in particular to that sell order and the algorithm used. But it is reported that the algorithm was passive and had some constraints tied to volume. This is a typical way investors attempt to minimize the impact of large orders. The most common order of this type is the Volume Weighted Average Price (VWAP). This order type attempts to match the price over the course of the day, weighted by volume. Sometimes volume measures are problematic (or instance, in currency trading), so there are variations such as the Time Weighted Average Price. In other cases the constraint is just a stay below percentage of daily volume (say 15%). Any combination of active and passive orders can be used meet one of these objectives. But if an order is passive and is tied to the volume traded or the size of the order book it could be identified. Smart firms will make an extra effort to disguise the logic of the order.

So how can a passive order move prices? Aggressive orders cross the bid ask spread and make new prices. Passive orders might just join the best offer. For example, if the market for S&P 500 futures is 1170.00 bid for 400 contracts and 300 offered at 1170.25, the passive order might offer 60 contracts at 1170.25. If the market trades lower and takes out all the 1170.00 bids the new inside market might be 1169.75 bid for 300 contracts and 200 offered at 1170. The passive algorithm might modify its order to offer 60 contracts at 1170.00. But if the algorithm is programmed to be 20% of the offer then it would only offer 50 contracts. Now 250 contracts are offered at 1170.00 and 20% of that offer is the passive order. If the passive order keeps updating in this way it could be identified and a strategy can be created to take advantage of this information.

Imagine that Clever Trevor Trading, LLC has identified the passive order and the market is now 1169.75 bid for 20 contracts, behind that the book is pretty thin with a bid of 1169.50 for 20 contracts and 1169.25 for 50 contracts. 250 contracts are still offered at 1170.00. Clever Trevor puts in an order to sell 220 contracts at 1169.75. That clears out the 20 in the book and now 200 are offered at 1169.75 and the passive order modifies its price to offer 50 contracts at 1169.75. Clever Trevor has priority in the queue but if he bids 1169.75 for 20 contracts he wouldn't trade with himself since this is not permitted. The exchange would cancel his order and he would trade with the passive order to scratch the trade. This is close to a free option but he still has he risk that someone else will lift his offer. His advantage lies in the thinness of the bid side of the book. But he could be clever and get rid of this risk. He could add new orders to the 1169.75 offer that are behind the passive order in priority, then cancel his earlier offer that were ahead of the passive order This way the passive order maintains its 50 contracts on the offer, but Clever Trevor can now bid 1169.50 to cover his 20 contracts and know that if the market starts to trade at 1169.75 he wont be lifted first. That way he can close his trade by lifting the remaining passive offer.

Repeated use of this strategy would drive the market down with aggressive orders while the passive order follows, offering a sort of option-like protection. This is very much like what other people mistakenly call "front running." (It may not be nice but it is not “front running”). The problem is the passive order has given away its strategy and someone else uses an aggressive strategy to monetize this information. So how does spoofing come into play?

If the passive order depends on the size of the order book, then increased depth in the order book could increase the size of the passive order. Now there is an increased amount of protection offered to the predatory firm trading ahead of the passive order, thus increasing the number of bids taken out of the order book and leading to a steeper drop in the market.

Is this Possible?

The example is totally made up to make a point but there is real evidence that people can capitalize on the predictability of others. In 2010, two Norwegians who had profited from interacting with a predictable trading bot and were convicted of manipulation and later this conviction was reversed. It is also obvious that the spoofer was leaking information by entering in orders of 188 and 289 contracts. (It could be that the 400, 500 and 2000 lot orders were obvious as well, but it could also be tricky to spot in real time). In equity markets a form of information leakage goes like this: A mutual fund wants to sell 50,000 shares of a mining stock through a broker. The broker then tries, in good faith, to minimize the impact of that order. The problem is that he puts in an order to sell 16,667 shares and follows that up with another 16,667 share order and a 16,666 share order. These are not common order sizes and it isn't difficult for a firm like Clever Trevor to divine that the first of these is part of a larger sell order and profit from this. But it isn't easy either and those who really know what is feasible and what isn't probably wouldn't say.

The Flash Crash Explanations are A Spoof

The Flash Crash was a wonderful horrible event. The horror, for some, was the extreme price movements. Another horror is the question: "What caused the Flash Crash?" This question is often asked and answered with the assumption that there is a single cause or simple narrative. I blame Occam's Razor—or a misunderstanding of it: "The simplest explanation is usually the correct one." Financial markets are complex and a non-false answer to the question what caused X, is often long, complex yet still incomplete. This is unpalatable to many and others reject it using a rule of thumb that favors parsimonious explanations.

Yesterday, a guy was accused of manipulating the S&P 500 futures market and even though the criminal complaint said that this activity "contributed to the Flash Crash," many have inflated this claim to "some guy caused the Flash Crash." (Though at least one headline seems obviously facetious). I think the word "contributed" implicitly supports the no-single-cause view and the CTFC is more careful in their complaint saying:

"Defendants' actions contributed to an extreme order book imbalance int he E-mini S&P market. This order book imbalance contributed to market conditions that caused the E-mini S&P price to fall 361 basis points."

The CFTC complaint includes more interesting details than the Justice Department complaint does.

How Spoofing Might Work

What follows is a not-realistic but not-too-unrealistic example of an order book for the E-mini futures contract to show how spoofing could work. So here is an order book:


Bids Price Offers
1170.75 800
1170.50 1200
1170.25 1000
1000 1170.00
1200 1169.75
800 1169.50

Can you guess what price the next trade will take place at? Likely, it will be at 1170.00 or 1170.25—though not necessarily. Suppose the inside market evaporates (say, because of spoofers canceling or the anticipation of news) then the price could gap up or down. Predicting whether the next trade is at the offer price or bid price is difficult. The book illustrated here is evenly balanced between buy and sell orders—gut instinct would say there is an equal chance of an up or down move. We would discover the momentary price of the futures contract if someone places a limit order to buy for 1170.25 or to sell at 1170.00. The order book changes as new orders come in and other orders are modified or canceled.

Suppose a series of trades like this (read @ as "contracts trade at"): 15 @ 1170.25, 5 @ 1170.25, 5 @ 1170.00, 245 @ 1170.00, 400 @ 1170.00. The order book now looks like:


Bids Price Offers
1170.75 800
1170.50 1200
1170.25 980
350 1170.00
1200 1169.75
800 1169.50

Now that the order book in no longer balanced a common belief is that the next trade is more likely to be lower. The idea behind spoofing is that placing large orders to sell in the order book will make people believe price will decrease and cause them to sell. Such an imbalance in the order book is thought to have contributed to the Flash Crash. But how many people will trade based on an order book imbalance?

Why Spoofing Might not Work

Firstly, it seems clear that this guy’s strategy—spoofing or not—worked since this guy allegedly made an enormous amount of money. But it should work for some of the people some of the time, and not for a large enough portion of the market to contribute to a crash. An assumption about who were victims of the spoofing is key to many people's judgments about spoofing. If high frequency traders are the victims, it seems it would be the ones who try to provide liquidity not the type allegedly trying to anticipate orders.

The traditional view of a market maker is a firm trying to make the bid-ask spread. So if a firm called Special Sauce Trading, LLC sold 5 contracts at 1170.25 and bought 5 for 1170.00, then that firm has revenue of a quarter of a point on 5 contracts: 5 * $12.50 = $62.50 less commissions, other fees and costs. A nice business, but for that to happen the firm would have had to be second in the queue on the offer side and first in queue on the bid side. Place in the queue is important for capturing the bid ask spread because the S & P 500 futures contracts (unlike Eurodollars) use a FIFO matching algorithm (see here and here).

Suppose the next changes in the order book are a trade: 20 @ 1170, and the following new orders and cancelations: 1170 bid for 100 contracts canceled, 1170 bid for 20 contracts canceled, 1170 bid for 200 contracts canceled, new offer of 20 contracts at 1170.25.


Bids Price Offers
1170.75 800
1170.50 1200
1170.25 1000
30 1170.00
1200 1169.75
800 1169.50

Why were all those bids canceled? One explanation is this: Before when the order book was the same on both sides, some of the orders were resting at each price to ensure a place in the front of the queue. But if you pay 1170.00 when there are less than 350 other bids at 1170.00 and 980 offered, what is the probability of selling at 1170.25? Suppose Weak Sauce, LLC bought at 1170 and then placed an order to sell at 1170.25. The firm would be last in the queue to sell at 1170.25 and would only capture the bid ask spread if new orders to buy came in at a much faster rate than new orders to sell. The alternative to selling at the offer is to sell at the bid price and scratch the trade, but now there is a greater possibility that the bids will evaporate before Weak Sauce decides to offer at 1170.00 In this example, the other market makers canceled the orders to buy but left in orders to sell at 1170.25 because selling at this price is good: now that there are only 30 contracts on the bid side, a seller at 1170.25 would could now bid 1170.00 and be only 30 contracts away from the front of the queue. Now that the 1170.00 bid is only 30 contracts a new sell order of 50 @ 1170.00 would result a new offer price of 1170.00, the highest bid would be 1169.75 and Weak Sauce would likely take a loss.

There are a number of academic papers that try to figure out how to calculate the probability that the next trade will be at the offer price (or bid) using the state of the order book. The math is complex, and it in unclear whether it works, but the idea is the same as the instinct of a naïve trader: use order book information to predict price direction. If manual traders and computer models both sell if the order book is heavy with sell orders, then a series of large orders to sell above the offer price could beget selling. But if market makers are entering orders to get a queue position then they will be on the look out for other orders that get canceled early and often and hard to understand why they would be deceived by fake orders.

It is unclear how much the bid ask spread contributes to the profitability of all the trading trategies in S & P 500 futures. It is clear that everyone has thought about trying to make money from the bid ask spread or reducing execution costs by attempting to sell at the offer or buy at the bid. It is the group reducing execution costs that I believe (without evidence) is more likely to be a victim of spoofing.

Legal Spoofing and Things That Look Like Spoofing.

Instead of entering a large fake order to get prices to move, it is legal in equity markets to place a large order but only show a small portion of it so that the market doesn't react. Maybe it is a stretch to call it spoofing, but it is meant to be deceptive. Instead of the intending to moving a price the intent is not to move it. It is hard to argue against these types of orders since a buyer could just enter a series of small orders, but it does interfere with an estimation of the queue size making market makers even more carful when using order book information. The allegations against the spoofer, is that he had software that automatically canceled the orders once they were within a few ticks of the best price and never took real risk. Still there is a legitimate strategy in which orders are placed far away from the market waiting for the rare fat finger trade that temporarily sweeps the order book and temporarily drives prices higher or lower. The question of manipulation could be determined by the cancel algorithm, context of related orders, price and size.

If repeated modification of orders that don't get filled looks like spoofing, much off the alleged widespread spoofing might be legitimate strategies. One class of market participant repeatedly modifying orders a couple of ticks from the best bid/offer might be firms attempting to arbitrage price difference between the S&P 500 futures and the $SPY or the a basket representing the index. These orders may be canceled/updated frequently since they are tied to other prices.

Rampant Spoofing, or is this One Big Spoof Spoof?

The arbitrage strategy raises another question: Could you spoof the $SPY ETF market with orders in the futures market? If so, how would regulators catch this? It seems difficult to impossible to catch subtle spoofing that is a small part of a large complex inter-market strategy. Some people believe this spoofing is widespread, but if this belief is widespread people would be cautious making spoofing less effective.

Some spoofing is easily identifiable. According to the criminal complaint, the spoofer repeatedly entered fake orders for either 188 or 289 contracts. That is pretty dumb. Orders like these are screaming to be noticed. Any higher frequency data analyst should be on the look out for bread crumbs like this, and more complex ones. Would-be spoofers could identify his spoofing and ride his illegal coattails. In this scenario there would not be many spoofers since they only need one guy to do the dirty work. Why would spoofing be widespread if you could reap the rewards without taking the legal risk?