What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On August 1, 2012, Knight Capital’s automated trading router sent a flood of orders into the market after a software deployment left a legacy defect active on an affected server. The event lasted about 45 minutes and Knight initially estimated its realized pre-tax loss at approximately $440 million. The SEC later found losses exceeding $460 million. “Forgotten server” is a shorthand for the deployment and control failures; it is not the SEC’s description of the incident.
What happened at Knight Capital?
At the market open on August 1, 2012, Knight’s SMARS automated router was handling 212 customer parent orders. Certain orders eligible for the NYSE Retail Liquidity Program activated defective legacy code on an affected server. The router did not properly account for completed executions and continued sending child orders into the market.
Over roughly 45 minutes, Knight sent millions of orders. The SEC’s 2013 administrative order reports more than 4 million executions across 154 stocks, involving over 397 million shares. Knight accumulated unwanted positions while trying to identify and resolve the problem, and remained connected to the markets, continuing to send orders in some securities.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How did the failure develop?
A dormant defect remained in the router
In 2005, Knight moved a section of code in its automated router. According to the SEC order, that change left a function defective, although Knight did not intend to use it. The defect remained in the system.
#1 Best Overall
A staged deployment left servers in different states
In late July 2012, Knight changed SMARS in preparation for the NYSE Retail Liquidity Program and deployed the new code in stages across its servers. The SEC order describes a deployment failure across the SMARS group: an affected server still had the old state when trading began. The combination of the old code and new program-related order flow exposed the legacy defect.
The router repeated orders instead of accounting for executions
When eligible orders triggered the defective function, the affected router failed to recognize executions properly. Rather than stop or reconcile its activity, it kept issuing child orders. A software defect became a market-wide incident because the router could continue operating at scale without controls that contained its orders or aggregate exposure.
What did Knight lose, and why do the figures differ?
The two widely cited loss figures refer to different statements at different times. Knight’s August 2, 2012 announcement gave an initial estimate of approximately $440 million in realized pre-tax losses. In its October 2013 order, the SEC found losses exceeding $460 million from the unwanted positions. The figures should not be treated as interchangeable: the first was Knight’s early estimate, and the second was the regulator’s later finding.
The SEC order also reports that Knight’s positions reached approximately $3.5 billion net long and $3.15 billion net short. Those figures describe the positions accumulated during the episode, not the loss total.
Which controls failed?
The SEC’s findings were not limited to the faulty code. They described weaknesses at multiple points between deployment, order entry, exposure monitoring and incident response.
- Deployment and testing: Knight lacked adequate controls to ensure code changes were properly deployed and tested across the router servers.
- Pre-trade controls: It lacked adequate controls immediately before orders entered the market to prevent erroneous orders from being sent.
- Aggregate exposure: Financial controls could not stop aggregate orders from exceeding preset capital thresholds. The execution account was not linked to automated firm-wide exposure controls.
- Incident response: Knight did not have sufficient written procedures for responding to a trading-system problem and continued to send orders while working to identify and resolve the issue.
- Supervisory review: The SEC found Knight had not adequately reviewed its market-access risk controls.
What warnings appeared before the market opened?
Before trading began on August 1, an internal system generated 97 automated emails that referenced the router and indicated an error. The SEC said Knight did not act on them that day. It also noted that the messages were not designed to function as system alerts. Their existence illustrates why operational warnings need a clear owner, severity, and escalation path; an email that is not treated as an actionable alert may not interrupt an automated failure.
What happened after the incident?
On October 16, 2013, the SEC announced that Knight agreed to a $12 million settlement over violations related to its market access controls. Knight agreed to the settlement without admitting or denying the SEC’s findings. The regulator’s central point was that fast-moving markets require strong compliance controls because failures can have substantial consequences for orderly trading.
Recommended Free Tools
What does the Knight incident teach about automated systems?
The episode shows how independent safeguards need to cover different failure modes. No single code review or alert is a substitute for controls that can prevent a bad deployment, constrain orders, detect abnormal aggregate exposure and halt activity during an incident.
Best Value
- Code and deployment safeguards: Track legacy code, test changes across every production instance, and verify that the deployed versions match before enabling a new program.
- Order and exposure limits: Enforce limits before order submission and at the aggregate firm level, rather than relying only on controls that operate after trades execute.
- Detection and response: Make errors visible through actionable alerts, assign escalation responsibility, and maintain procedures that let staff stop market access promptly.
These are the categories of control weaknesses identified in the SEC’s findings, not a ranking of particular technologies or vendors. The SEC’s October 2013 announcement quotes enforcement co-director Andrew Ceresney: “Given the rapid pace of trading in today’s markets and the potential massive impact of control breakdowns, broker-dealers must be held to the high standards of compliance necessary for the safe and orderly operation of the markets.”
Quick Recap
Sources
- SEC administrative order, October 2013.
- Knight Capital announcement, August 2, 2012.
- SEC settlement announcement, October 16, 2013.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
