If Joe Q. Daytrade knew that WorldCom was going to buy Sprint 10 minutes before the daytrading masses, he'd probably pop open his online trading account in a hurry.
This scenario may not be far off, if the vulnerability recently exposed at a major newswire service is any indication: A data-hole that displayed news releases to anyone with a Web browser appeared on news distributor PR Newswire's site late last week.
The company has yet to patch the hole but said it is working to resolve the matter.
The hole, found late last week by Colorado-based software consultant Tim Van Tongeren, is found in PR Newswire's Web page addressing scheme.
Van Tongeren said he was looking for a new release at the service's site Thursday and noticed that new releases were numbered in simple numerical sequence, by way of a number contained in the URL of each announcement.
"I was getting bored [having to repeatedly go back] to the headline news page, so I just started putting in new numbers," he said.
Voila -- he was soon reading news releases 10-20 minutes before they showed up on the PR Newswire site or other Web sources of press releases.
Day traders, analysts, and observers pointed out that such an info-leak could pay handsome returns to the intrepid stock-watcher.
"If some big announcement comes out 15 minutes early, they could make use of that and, if appropriate, trade on that information," said David Scott, marketing director for Newsedge, a real-time news service that distributes PR Newswire among its many feeds.
"It's a really big deal. You could see a situation where, if [the news] moves the market, they could make trades."
There are SEC disclosure regulations preventing the early release of company information to unauthorized sources. But the company, which acknowledged the presence of the hole, said those disclosure restrictions were not breached.
"There is no problem with our getting releases out for disclosure purposes," said PR Newswire spokesperson Renu Aldrich, "because by the time we send it even to our Web site, it's already gone out to 2,500 media points, which includes Dow Jones, Reuters, Bloomberg. They have hundreds of thousands of subscribers."
Plus, she said, the potential impact was reduced by the fact that the announcements are distributed to qualified media outlets well before they could be accessed via the glitch.
About 2,500 media and financial information points receive the data simultaneously, she said. "So even if someone gets it through the loophole it's still not really a problem for disclosure purposes."
Wired News used the loophole to access a company earnings report and recorded a 12-minute delay before the same announcement appeared on an internal newswire service. Another nine minutes passed before it appeared on PR Newswire's own Web site; and 18-20 minutes before it appeared on common free wire sources on the Web, such as Yahoo and ETrade.
So how meaningful would a 10-minute jump on news be to a daytrader?
"Very meaningful," said Chicago-based daytrader Damon Brill, especially if the news was say, WorldCom buying Sprint -- an announcement almost sure to send Sprint's stock price up.
"It would only matter if I were one of only a select few that obtained that information. However, if I did obtain that prior to most, I would be able to make pre-emptive buy or short-sell decisions that would allow me to beat the market."
Brill said he pays close attention to selected companies via business news wires, and "if [the news is] big enough, I react."
Earnings reports and acquisitions news are among the types of announcements that would be nice to have in advance, he said. "But I also know that many traders are as quick, if not quicker than I am. So I take most stories with a grain of salt."
That's the same reason Dave Otto, director of retail brokering for investment research firm Edward Jones, said a 10-minute advance wouldn't mean much for the average investor.
"The opportunity to buy or sell based on a press release is limited at best -- very limited," Otto said. "Even with the professionals, it takes them time to digest the information.... If you're very quick on the trigger and you're very lucky, there's an outside chance you can profit from the information."
Meanwhile, the company said the hole was at the very least a security issue it intends to resolve as soon as possible.
"We take security very, very seriously," said Aldrich. "We take a lot of steps to make sure that nobody gets an edge over someone else in terms of viewing material news."
