T2O4O1 11:24 FromMARAET SURVEILLANCE szizss6zase TtiT Puan Fase Memorandum REL oB00 mea ‘Byyse {Cae Opn September 17,2001 To Aldo vstne udith 8ryp . Date: December 3, 2001 From: Special Task Force via ple and Re; Special Investigation #01261 — Barbara Krupinski Post Terrorist Attack Review and 7 #01641 ~ Shor Interest Review; . Closed ~SEC Referrals Ccaectosed: Decomber3, 2001 Introduction In the aftermath ofthe events of September 11, 2001, and on September 17, 2001, when the New York Stock Exchange (the "Exchange" or "NYSE") opened for business forthe fist ime since that day, the NYSE inated a review of certain trading prior to September 11. On September 17, NYSE Market Surveilance staf received a cal from the SEC Division of Enforcement staff regarding the possibly that ents or individuals may have profted by trading in certain stocks while having prior knowledge of the events that unfolded, ‘A Special Task Force was convened to conduct the investigation into trading activity and the short interest review. A total of 25 individuals in Market Survellance, inctuding 2 Officers, 5 Directors, 12 analysts in Market Trading ‘Analysis |and Il, 2 attomeys ftom Special Counsel and 3 in Member Trading (1 Officer, 1 Director and * analyst) gathered and analyzed trading information and account documentation. In the early stages of the investigation, two attorneys from NYSE Enforcement assisted in obtaining follow up account information, Throughout these investigations numerous individuals made significant contributions. Member Trading staff questioned certain Trading Floor specialists. Markel Surveliance's Regulatory, Legal & Technical Support assisted with intemal Survellance systems and the various reports utilized as tools in the trading review. Member Finn Regulation assisted by locating the member firms displaced after September 11 and provided to Market Surveillance contact ‘names, teleplione and fax numbers, and addresses to which correspondence and bluesheet (trading information) ‘requests could be directed. Two individuals from the Securities Industry Automation Corporation (‘SIAC’) assisted NYSE staffon the technical side of the bluesheeting process, to the extent any fim’s abilty to electronically provide bluesheets to SIAC was impacted. Once all biuesheet data was received, Regulatory Systems assisted in ‘vansmitting that data to SEC Staff, A list of the individuals involved in these investigations is attached hereto as Exhibit A. Initially, the NYSE and SEC staff discussed the review criteria and the selected securities. The review also Included buy-side trading in other issues on September 17. Overall, the trading in 47 issues was reviewed. The sal-side Review Period wasSeptember 4 tough 10,2001, | yh 4. ssc r The 42 secures that experienced price depreciation were components ofthe following 4 industries: (a) Aifines(b) Lodging (c) Insurance (d) Brokerage. The 6 securities that exoerienced price appreciation on September 17 were in the Defense industry. One thousand ninety eight (1,098) biuesheets were requested. A Uist of securites bluesheeted is attached as Exhibit B.A list of Clearing Members bluesheetod is attached as Exhibit C. In total, ‘over 800,000 records representing over 1 bilion shares were reviewed (see Exhibit D)Page 2 Staff also reviewed sell and sell stort program trading activity inthe arin and insurance industries from September 4 through September 10, 2001, to determine if any patterns emerged regarding execution of programs restricted to these industries. Analysis did not reveal any activity that in and of itself warranted further review. The large sales noted were executed by the firms that are typically in the top ten in program trading weekly volume (Morgan Stanley, UBS Warburg, Lehman, Goldman Sachs). Additionally the programs would typically include stocks beyond those stocks within these two industries. There were a couple of large trades executed by firms in single stocks; however, these trades did not warrant further review as the firms noted had already been contacted by slaff for bluesheet information in those stocks. Trading Revi Methodology During the course of the review, a two-prong approach was uiilzed to detect suspicious trading. The firs! approach reviewed buesheet data in each secutly and the trading was reviewed one security at atime. In the second combined bluesheet data forall 47 securities was reviewed in one collective report. The single stock approach focused on large short sales and large sales in individual securities that expenenced price depreciation prior fo September 11. and large purchases in those stocks that experienced price appreciation oro Sentember 1 1, 9/11 LawEnforcementSer 9/11 LawenforcementSensitive ‘The second approach focused on accounts thal traded multiple securiies on the correct side of the market (e.9 ~2ecounts selling AMR cr buying RTN prior to September 11) and/or incividuaisfentities that traded through multiple accounts. The accounts were reviewed using @ Frequency Report that displayed trading details for all customer iD afymbers *Custids")' that waded in mare than one security BES aetrreeneeneane LawEnforcementSensiti Both approaches reviewed and evaluated the trading with consideration forthe date of the trades, account open date, account geographic location, and similarities to names provided fo the NYSE via the SEC from the FBI (the "FBI Name List). ‘These criteria were used to determine if an account was suspicious and/or should be included in list of accounts sent to SEC staf for their consideration. Findings ‘ During the course of the review, staff forwarded a total of 1,360 accounts with a total of 936 different Custlds ta) | SEC stat for ther consideration, A Master List of those accounts is attached as Exhibit E. These accounts were “forwarded to the SEC Staff with the understanding that the selected accounts were to facilitate their review of trading prio: to September 11, 2001. The accounts were forwarded via fax to SEC staff as they were reviewed. As discussed in SG/SEC and other Government Contac, staff held routine discussions with SEC sttf relating tothe accounts forwarded for their consideration. In some cases, SEC staff stated they would follow up on spectic accounts and in others, they requested staff to obtain further information (see Account Follow-up). Of the accounts forwarded to the SEC, 511 traded in multiple securities during the Review Period. The 849 ‘maining accounts traded in only one security. A total of 68 accounts forwarded to the SEC traded in more than 5 secures. A separate lst ofthese accounls is attached as Exhibit F. {As discussed above, in addition to accounts that traded in multiple secunties, overall raging was reviewed fo detect accounts with large transactions and accounts with suspicious account characlerislics such as the account open Social Sscunty number or TaxlO numberPages dates, geographic location, and names simiar to those appearing on the FBI Name List. A higher level of scrutiny was employed on accounts based on these critera, and except for large transactions an account had to meet two of the above criteria to be forwarded to the SEC. Below are examples of the applied review criteria Large Short Sale/Proft Potential - Based on the potential profit by seling shor specific securities priorto. September 17, accounts that sold short alarge number of shares were forwarded to the SEC. For example, staf forwarded 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive:seener 7.2001 a1a profit potential for the account was $966,678, (See Master List) Large Sale/Buy Volume - Steff believed that individuais/entties possibly trading on advance knowledge ofthe terrorist attacks Could possibly attempt to deceive regulators by entering short sales as long sales. Further, those with knowledge of terorist activites would liquidate existing long posiions or increase existing shart positions in stocks whose industries were detrimentally affected and/or estabiish long positions or cover existing shor positions with large purchases in stocks whose industries would be positively impacted, That being considered, large purchases andicr sales on the vantage side of the market were forwarded to the SEC. Accounts that met ther citeria discussed herein were reviewed as more suspicious. For examole. staff referred the acount" 9/11 LawEnforcementSensitive September 5, 2001. This account had a larae sale. the date of which was clase in time to September 11. i was 9/11 LawEnforcementSensitive Recent Account Open Date - A total of 465 accounts were forwarded to the SEC that had an accgunt Ch date ‘after May 1, 2001 (approx 4 % months prior to September 11). 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive Names ~ Account names were matched against alist of possible terorist or terrorist organizations which was provided on the FBI Name List. The names of the accounts that traded were reviewed for matches ot similarities to that st. No fine matches (maich of first and last name) were discovered. However, several accounts were forwarded based on commonality of sumames. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive Geographic Location - Accounts that were lacated in areas matching a list of geographic locations provided to te Exchange by the SEC (Exhibit G) were also considered with a high degree of susoicign *"? 9/11 LawEnforcementSensitivePage 4 9/11 LawEnforcementSensitive These accounts were also forwarded only if they were noted on the vantage side ofthe market and had a sel, sell short or buy date relative in time to the September 11 attacks. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive | a] During the course of this investigation, a news magazine had pred significant developments with respect to the discovery of a major terrorist cell in Milan, taly. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive These accounts were seen on both the sell-side and buy-side of our review. A document detailing these accounts is attached as Exhibit H. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive data had already been included in the Mester List of accounts discussed with and forwarded to the SEC. The SEC requested 2 report"! Lmestrcenentsersney hich was faxed on October 31, 2001 Concentration From Money Managers - On initial review of accounts, staff noted that some accounts were imanaged by the same money manager and had similar trading pattems. When reviewing the buy side for irading in the defense stocks, staff noted a concentration by one money manager. This concentration in trading was faciitated through various clearing members but all had the commonality of being managed #77 Lawenercamenssensie 9/11 LawEnforcementSensitive “emer This information was forwarded to the SEC on October 2, 2001 Unexecuted Short Safe Orders - Clearing Members who were bluesheeled were asked to provide information ‘Gonceming any large short sale orders that were entered, but not executed during the Review Period. A spreadsheet, attached as Exhibit J, identifies the accounts that were reported as having entered short sale orders that were not executed. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive * Along with the extensive biuesheet submissions for common stock, staff was also inadvertently sent a few bluesheets for coptons actayPages ‘The complete Master List of accounts was sent fo the SEC on November 14, 2001 Short Interest Revi Following the events of September 11, Markel Trading Analysis analyzed the September 2001 Open Shot interest figures on 47 listed issues impacted by the events of September 11, 2001. In addition to the issues reviewed by the Special Task Force, other issues were included due to company inquines andior nancial media coverage. Of the 47 issues that were the initial focus ofthis analysis, which included a review back to June 2001, the list was pared down as fotows 4, 9/11 LawEnforcementSensitive 2 For those issues meeting the criteria for issues selected under #1 above, Exchange member organizations that reported an overall increase in their August Open Short Interest figure of more than 10,000 shares were denied ‘These firms were then requested to submit information to the Exchange on the accounts that caused the increase in September's Open Short Interest figure. On the five issues thal wete analyzed pursuant to #2 above, eny Exchange member organization that reported a decrease in their September Open Short interest figure 9/14 Tagore 2 ™RUESe to rish nfo on azzuns ht caved the dine Sepembers snbittisfest myile’or" Resulting from this inital analysis, staf requested the information to complete its review from 36 NYSE member cxganizations. The information received from these member organizalions was reviewed to ascertain whether any ofthe accounts in question warranted immediate follow-up. The information was input into a spreadsheel pplication to facilitate data management and review, On November 9, 2001, staf forwarded a copy ofits findings to SEC staf, The information provided was subsequently discussed in a conference call with SEC staf. Accounts that surfaced in other September 11 reviews ol trading were identified inthis conference call and stat was asked to provide additional data on the following three accounts 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive 9/11 LawénforcementSensitive Allo! the information requested by SEC stat was forwarded to them by November 13, 2001,Page 6 Name Searches As previously discussed, Staif matched the FB! Name List against our bluesheets. The comparison resulted in 7 possibe fst and last name matches, as well as numerous last name matches. This information was forwarded to SEC staff Additionally staff matched those names on the list wih Social Secunty numbers, as well as additional names without Social Security numbers, interest was expressed by the SEC, 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive this information was also provided to SEC staff. Staff also matched the inital st cf terrorist entities (September 24, 2001) against the Unusual Actwity File, with a result of no direct matches. For certain accounts on the Master List9/11 LawEnforcementSensitive 9/11 LawenforcementSensitive in tis mvestgaton, name searches were conducted” with SEC Stat "> Any resuitng matches of nate were discussed ISGISEC and Other Government Contact inlermerket Surveilance Group (ISG) ~ During the week of September 17, staff contacted tne Chicago Board of Opiions Exchange (CBOE) staf fo discuss tne need for possible coordination and status of current review as well as fulure investigative steps ft leanned of the scope of the CBOE review and since the SEC staff was coordinating this review, ISG coordination did not appear to be necessary. However, staff included additional securities in the "buesheeting” efforts as a result of these discussions, Staff also exchanged with the CBOE lists of the issues biuesheeted in the respective reviews, The NASD Regulation Inc. (NASDR) initally contacted us to inform us that it was bluesheeting in numerous ‘ssues xing 6 NYSE listings. Staff had already bluesheeted the 6 issues for a two month period going back to July. The NASDR informed staff it would provide these bluesheets to staff once received by them. Securitas and Exchange Commission (SEC) ~ On September 17, staff discussed the scope and criteria of the NYSE review with the SEC staff. A protocol was agreed with the SEC staff to brief them on a daily basis. These daily meetings continued for three weeks unti statf had completed approximately 95% of the trading to be reviewed Two additional weekly meetings were held unti staff completed 100% of the trading review. ‘Task Force members and SEC staf (Joseph Cella and Mark Lineberry) participated in conference calls on the 21%, 24%, 25%, 26M, 27% and 28% of September, the 1, 2°, 3%, BP 108, 15", 23% and 31 of October, and the SF of November. The conference calls were held to discuss accounts that had large and timely selling or short seling (or bouying in the defense stocks) or other suspicious activity based on the daily analyses of bluesheets being conducted by the Task Force. During these conference calls, NYSE staff discussed accounts of interest and approprate follow-up with NYSE member firms. These folow-ups included requests for new account information, monthly account statements, and contact persons for the account. 9/11 LawEnforcementSensitive, 9/11 LawEnforcementSensitive Cher meatinas were held to discuss specific noted tadina. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive US.Atlorey - On September 2, Ken Breen, Assistant U.S. Attomey for the Eastern District of New York, ‘coniacied slalf, Mr. Breen had been assigned to the Financial Review Group, reviewing anc coordinating capital market issues in connection with the terrorist attacks. Mr. Breen had been working with the SEC and he informed staff that findings should continue to be given to thePage 7 SEC staff. Additionally, a protocol was discussed to immediately facilitate information to him should the need arise. This protocol would involve the Market Surveillance Special Counsel Unit. Account Follow Up Prior to each conference call with SEC staff alist of the accounts to be discussed was faxed to Mr. Cella. During the conversations, staff identified accounts within the list that had elevated suspicion levels due to factors such as recent account open dates, trading in multiple securities, foreign location or high volume transactions At the request of the SEC, additional information for 71 accounts was obtained. This information included, among other data, new account documents, account statements, contact names and telephone numbers, order information and/or bluesheet intercase analyses, etc. The information was faxed or mailed to the SEC as received or, when appropriate, related verbally Additional folow up was conducted on the accounts sted in a schedule attached as Exhibit K. If account statements were obtained, Task Force members reviewed those statements for any suspicious activity. Where activity of note existed, such as large portfolio liquidations or money transfers, SEC staff was informed, SEC stat also requested information concerning specific concentrations of activity. In response, staff faxed additional data including 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive See the Master List (Exhibit €) for annotations containing the specific follow up conducted. New account documents and other account information provided to the SEC are incorporated by reference herein and are available for inspection in the investigative file. Accounts that were discussed during the conference call but for which MTA staff was not requested to obtain additional data are also annotated on the Master List. 9/11 LawEnforcementSensitive ur findings were discussed with SEC staff. Follow up on this trading was conducted by the SEC staffPage 8 Specialist Surveillance At he beginning ofthis investigation, staff, via the Member Trading Department (Specialist Surveilance) of Market Surveillance, obtained information from the relevant specialists regarding unusual sales anor short sales in various U.S. afines stocks during the period immediately preceding September 11. The information which ‘Specialist Surveillance gathered was ultimately supplemented by more extensive bluesheet information as well as information about large unexecuted short sales from the fms which were bluesheeted. This intial informaton assisted slaft in identifying at an early stage those fms with significant activity in these issues. Other Related Reviews 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitivePage 9 9/11 LawEnforcementSensitive Conclusion ‘The Soecial Task Force has completed its review with all relevant information forwarded to SEC staff, This matter is being closed at this time. A copy of this memorandum is being forwarded to SEC staff for their information The above information is being sent to the SEC for surveillance purposes only, and confidential treatment is being requested pursuant to the Freedom of Information Act and the applicable SEC Rules thereunder: Such treatment is requested on the grounds, among others, that the information submitted may contain confidential financial data of private parties, as well as sensitive surveillance data whose disclosure may significantly impair the effectiveness of the Exchange's self-regulatory mechanism. Accordingly, should any request be made for disclosure of these materials, or their contents, it is asked that the Exchange be notified of this fact immediately, giving us a chance to interpose our objections. C: Joseph Cella US Securities and Exchange Commission - Washington, DCPage 10 Exhibit A Exhibit Exhibit © Exhibit Exhibit E Exhibi Exhibit G ExibitH Exhibit Exhibit J Exhibit k EXHIBITS List of individuals involved in the investigation of trading and who assisted in the gathering of documentsfinformetion, as well as systems support Spreadsheet sorted by symbol which identifies all securities bluesheeted inthis investigation. Spreadsheet sorted by Firm which identifies all Exchange member firms from which bluesheets were requested in tis investigation. List of securities for which bluesheets were received. This lst shows the number of records received and the number of shares represgnted on those bluesheets (categorized by buys, sales, and short sales) Master List of accounts discussed and forwarded to the SEC. Includes annotations of account follow up, List of 58 accounts which traded in 6 or more securities. All were discussed with the SEC. of significant geographic locations provided by the SEC. 9/11 LawEnforcementSensitive 9/11 LawEnforcementSensitive Spreadsheet of accounts which entered short sale orders but were not executed, ** ¥srtrerewentn 9/11 LawEnforcementSensitive List of accounts for which follow up was conductedWITHDRAWAL NOTICE RG 148: Records of the National Commission on Terrorist Attacks Upon the United States (9/11 Commission) Series: Master Files Document Number: RSEC 03003652E Date: 12/03/2001 Description: Exhibits n for withdrawal: law enforcement sensitive Box Tok 33 Withdrawn by: kw, 6/4/2015