On April 16, 2010, the U.S. Securities and Exchange Commission filed a civil complaint in the Southern District of New York against Goldman, Sachs & Co. and one of its vice presidents. The subject was a synthetic collateralized debt obligation called ABACUS 2007-AC1. Its declared function, stated plainly in its own marketing materials, was investment: a portfolio, selected by an independent manager, offered to investors as an ordinary allocation of risk.
A portfolio selected by whom
The SEC’s complaint told a narrower story than the marketing materials did. A hedge fund with a financial interest in the portfolio’s failure had played a role in selecting its contents — a role the marketing materials never disclosed. Investors lost more than a billion dollars. The fund on the other side of the position made close to the same amount.
Three months later, on July 15, 2010, Goldman agreed to pay $550 million — at the time the largest penalty in SEC history against a Wall Street firm — and settled “without admitting or denying” the underlying charges. It did, however, concede one specific thing in writing: that its own marketing materials “contained incomplete information.” A declared function — investment vehicle — and an admitted gap between what the paperwork said and what the paperwork left out. The regulatory remedy itself was built the same way the product was: enough disclosed to close the file, nothing disclosed that required anyone to say, in so many words, what had happened.
Thirty-six minutes, no single hand
Three weeks after the SEC’s complaint, on May 6, 2010, a separate mechanism performed a separate demonstration. Beginning at 2:32 p.m. Eastern time, and for approximately thirty-six minutes, close to a trillion dollars in market value disappeared from U.S. equities and reappeared almost as quickly. The infrastructure responsible — high-frequency trading systems whose declared function, repeated for years beforehand by the firms that built them, was “liquidity provision” — was found by the joint SEC–CFTC report that followed to have behaved rather differently under stress. When conditions tightened, the same systems that supplied liquidity in calm markets withdrew it in the space of seconds, each one following its own logic, none of them coordinated, all of them contributing to a single afternoon that erased and restored a trillion dollars without a recognizable author.
No regulator alleged intent. No single firm was found to have caused the crash. That absence of an author is not a gap in the investigation — it is the finding. A system can be engineered to a declared purpose and structurally capable of the opposite, and when the opposite occurs, there may be no one left standing to ask.
689,003 people who never knew
Four years later, a third mechanism was demonstrated in public, by its own operators, without any regulator’s involvement at all. In January 2012, Facebook’s Core Data Science team, together with researchers from Cornell, adjusted the news feeds of 689,003 users for one week, reducing the amount of either positive or negative content each group saw. The declared function of the feed — relevance ranking — had never included emotional intervention. The published result, in the Proceedings of the National Academy of Sciences in June 2014, showed that it did not need to. Users who saw less positive content used more negative words in their own subsequent posts. Users who saw less negative content used more positive ones. Emotional states, the paper concluded, had been transferred at scale, through a system with no stated capacity to do so, to people who never learned they had been selected.
PNAS itself later issued an editorial expression of concern over the study’s consent. Consent, in this case, had consisted of a data-use policy every user had already agreed to simply by opening an account.
⬥
Three declared functions — an investment product, a liquidity mechanism, a relevance algorithm — none of them announced as instruments of concealment, deception, or influence, and all three, on the public record, capable of exactly that. In each case the ambiguity was not exploited after the fact. It was present in the design from the start, waiting to be useful to whoever needed it, and useful in the meantime to no one in particular — which is, perhaps, the most efficient kind of deniability there is: none is needed if no one ever has to explain what happened.
A tool that could only ever do the one thing its label says is a rare tool. What, then, should be assumed about the tools whose declared function nobody has ever been in a position to test?
