Cyber And The City: Securing London’s Banks In The Computer Age

231 Pages·2022·4.659 MB·English

by  Ashley Sweetman

History of Computing
Ashley Sweetman
Cyber
and the City
Securing London’s Banks
in the Computer Age
History of Computing
Founding Editor
Martin Campbell-Kelly
Series Editor
Gerard Alberts, Institute for Mathematics, University of Amsterdam,
Amsterdam, The Netherlands
Advisory Editors
Gerardo Con Diaz, University of California, Davis, CA, USA
Jack Copeland, University of Canterbury, Christchurch, New Zealand
Ulf Hashagen, Deutsches Museum, München, Germany
Valérie Schafer, ISCC, CNRS, Paris, France
John V. Tucker, Department of Computer Science, Swansea University,
Swansea, UK
The History of Computing series publishes high-quality books which address the
history of computing, with an emphasis on the ‘externalist’ view of this history,
more accessible to a wider audience. The series examines content and history from
four main quadrants: the history of relevant technologies, the history of the core
science, the history of relevant business and economic developments, and the history
of computing as it pertains to social history and societal developments.
Titles can span a variety of product types, including but not exclusively, themed
volumes, biographies, ‘profile’ books (with brief biographies of a number of key
people), expansions of workshop proceedings, general readers, scholarly expositions,
titles used as ancillary textbooks, revivals and new editions of previous worthy titles.
These books will appeal, varyingly, to academics and students in computer
science, history, mathematics, business and technology studies. Some titles will also
directly appeal to professionals and practitioners of different backgrounds.
Ashley Sweetman
Cyber and the City
Securing London’s Banks
in the Computer Age
Ashley Sweetman
King’s College London
London, UK
ISSN 2190-6831 ISSN 2190-684X (electronic)
History of Computing
ISBN 978-3-031-07932-0 ISBN 978-3-031-07933-7 (eBook)
https://doi.org/10.1007/978-3-031-07933-7
© Springer Nature Switzerland AG 2022
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of
the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology
now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
The publisher, the authors and the editors are safe to assume that the advice and information in this book
are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the
editors give a warranty, expressed or implied, with respect to the material contained herein or for any
errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional
claims in published maps and institutional affiliations.
This Springer imprint is published by the registered company Springer Nature Switzerland AG
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Acknowledgements
This book is based upon my PhD research undertaken in the Department of War
Studies at King’s College London. For this comprehensive schoolboy from Neath,
South Wales, writing those words still feels surreal.
There are so many to thank for their support along the way, including the official –
who shall remain unnamed – who prompted this work by suggesting there was little
understanding in government of what might happen should a bank collapse as a result
of a cyberattack.
Thanks must go to Michael Goodman, Thomas Rid, Jon Agar, Richard Aldrich
and John Ferris, all of whom provided support and input to this and related work as
either supervisors, external examiners or interested reviewers. Thanks also to Peter
Hennessy, whose writing of contemporary history provided the ultimate inspiration,
and whose tea, cake and wisdom have always been gratefully received. The same
must also be said for Mark, with whom many hours have been spent ruminating on
cyber security, and the world, over hot chocolate.
Studying for a PhD was made far easier by being part of a cohort in the form of my
Strand Group colleagues. Jack, Michelle, Martin, Eleanor and Jan all provided fun and
friendship, and a commitment to teaching and writing contemporary history that was
infectious. The Strand Group’s visiting professors, including Iain Lobban and Simon
Case, must also be thanked for sharing what they could of their knowledge and experience.
Conversations with experts have also provided vital background to this work.
Among those to be thanked are Gordon Corera, Jeffrey Yost, Will Dixon, Paul
Dorey, Mark Waghorne, Fred Piper and Maria Vello. I am grateful to all at Springer
for their work in pushing this book through to publication.
It would be an understatement to say that meeting Jon Davis was a pivotal
moment in my academic career. Thank you, Jon, for the patience to read multiple
versions of this work along the way, for the opportunity to pursue postgraduate
study at all, and for your friendship.
To all four of my parents, and to Amie and Lydia, I could not be more grateful for
your love and support in all its forms.
And finally, Elle – for absolutely everything, including finding me a place at the
Mile End Group event which set me on this path – thank you.
v
Contents
1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2 The London Clearing Banks and Computer Security:
1960–1977. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
3 BACS: 1971–1980 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
4 SWIFT: 1972–1984 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
5 Consolidating Growth: 1978–1985 . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
6 CHAPS: 1972–1984 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
7 Hacking It: 1985–1995 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221
vii
Chapter 1
Introduction
Banks have acted as secure stores of wealth for millennia. William Mitford, in his
famous History of Greece, described how temples fulfilled such a role in that coun-
try’s Ancient existence. ‘In the general insecurity of property in the early ages … it
was highly desirable to convert all that could be spared from immediate use into that
which might more easily be removed from approaching danger’, wrote Mitford.
‘Gold then and silver having acquired their certain value as signs of wealth, a deposit
secure against the dangers continually threatening not individuals only but every
town and state in Greece would be a great object of the wealthy. Such security
offered nowhere in equal amount as in those temples.’1 And, with remarkable con-
sistency, the broad parameters of banking have continued since.
Today’s temples are the giant global banks whose vast buildings stand at the
centre of major cities. They form a critical part of the global financial infrastructure
responsible for storing and transferring trillions of pounds around the world on a
weekly basis. Those institutions’ understanding of security is different than that of
their Ancient Greek predecessors, despite the continuity in their fundamental
purpose.
Cyber security is universally recognised as crucial to the successful operation of
the financial sector, with little questioning of the vast sums of money invested by
organisations in capabilities required to protect them. But how did banks become so
reliant upon computers and networks that their business operations – and very exis-
tence – came to depend so heavily upon “cyber”?
To answer this question, an historical approach is informative, though scarcely
forthcoming. Understanding how banks have defined computer or information secu-
rity (what is broadly referred to today as “cyber” by chief executives and world
leaders), what they perceived to be the main threats they faced and how they
defended themselves against them, allows us to trace the origins of cyber security in
the financial sector and explore in detail how, in the second half of the twentieth
1 William Mitford, The History of Greece: Volume I (London: T.Cadell, 1829), p. 193.
© Springer Nature Switzerland AG 2022 1
A. Sweetman, Cyber and the City, History of Computing,
https://doi.org/10.1007/978-3-031-07933-7_1
2 1 Introduction
century and beyond, “cyber” has emerged as the pre-eminent concern for major
public and private entities.
For the London clearing banks as they were then known – the largest, most
prominent financial institutions, including Barclays Bank, Lloyds Bank, Midland
Bank, National Westminster Bank, Coutts (part of National Westminster from
1969), and Williams & Glyn’s (established in 1970) – this process began in the early
1960s, prompted by their first purchases of mainframe computers. Over the follow-
ing decades, these institutions embedded computer and network technology into
their operations at unrelenting speed. From the outset, they recognised the funda-
mental importance of protecting the data and wealth that they stored and transferred
for their clients. It is to this era of rapid modernisation and technological advance-
ment that the origins of cyber security in banking can be traced. And it is this era
that is explored in detail for the first time herein.
Security and Trust
At the heart of this story is the relationship between security and trust. Customer
trust was and is vital to these institutions’ survival. A bank could not tolerate a repu-
tation for insecurity. Without the ability for customers, be they individuals or organ-
isations, to trust institutions to secure their wealth, the banking sector would likely
exist in a very different form, if it existed in any formal way. The stark images of
customers queuing outside branches of the British building society Northern Rock
to withdraw their deposits in late 2007, following the announcement that it required
Bank of England support in the early months of the global financial crisis, demon-
strate how quickly consumers can react, albeit in an extreme case, when they lose
trust in financial institutions. Certainty and security are therefore not just prized
currency for banks but operational necessity, whether guarding precious metal in
Ancient Greece or computer records of shareholdings and account balances in
twenty-first century London.
So deeply embedded at the core of their function, maintaining the trust and con-
fidence of customers drove’ computer security thinking and action for banks in the
second half of the twentieth century. This was visible both in their institutional
decision-making and in the system-wide infrastructure they developed in collabora-
tion with each other. It was the justification, often unspoken, for substantial invest-
ment in security features and the reason for detailed discussion and continual
reassessment of their security approaches.
Explicit references to trust are found throughout the documentation of banks in
this period. A 1972 booklet produced jointly by the clearing banks, for example,
described what they felt was ‘the most important of all the characteristic features of
banking’, namely: ‘nobody will trust his wealth with an untrustworthy person.’2
2 HSBC, File UK1793-0013, ‘A History of Banking’, Bank Education Service, March 1972, p. 6.
“Cyber” in Context 3
They described how historically the ‘merchants who turned to banking had to be
men who were trusted by the whole community.’3 The banks maintained this view
and extended it to encompass the new systems they created and the software and
hardware they became reliant upon. ‘Nobody can use the system if it can’t be
trusted,’ was how Barclays summarised the importance of this quality to their devel-
opment of a real-time dealing system in the mid-1980s.4 This succinct statement
epitomises the outlook of the banks throughout this period.
“Cyber” in Context
This book explores the clearing banks’ comprehension and management of com-
puter security as a means of garnering trust from their customers before the inven-
tion of the World Wide Web. In doing so, it injects rare historical context into
contemporary debates around cyber security, particularly in the financial sector. As
the historian of computing Paul Ceruzzi has said, ‘We live in an age transformed by
computing. This is also the reason why we need to understand its origins.’5 This
book attempts to add detail to our existing understanding of computer security,
which as Jeffrey Yost has argued, has a much longer history than most of the litera-
ture on the issue implies.6 Few attempts to understand the historical context of
“cyber” in banking exist, despite how long it has been a concern for those institu-
tions and therefore the potential that exists to learn lessons by revisiting past actions
and events.
Held in the archives of the aforementioned banks are troves of evidence relating
to computer security in this period. Little to none of this has been explored in aca-
demic work until now. It is difficult to know what, if any, material is yet to be
released, but the documents which are available provide a solid basis for a first writ-
ing of history, offering a detailed insight into the thinking and decision-making of
the major clearing banks in the late decades of the twentieth century. Researching
these archives and piecing together the available evidence into a coherent narrative
has therefore been both the primary opportunity and challenge of this project.
Presented here is the first exploration of the origins of financial sector computer
security in the United Kingdom.
3 Ibid.
4 Barclays File 0222-0049, ‘Real-time Dealing System for BZW’, 27 March 1985, p. 2.
5 Paul Ceruzzi, A History of Modern Computing: Second Edition (Cambridge: MIT Press, 2003).
6 Jeffrey Yost, ‘A History of Computer Security Standards’, The History of Information Security: A
Comprehensive Handbook (London: Elsevier, 2007), p. 596.