Bangladesh Bank’s international transaction system at serious risk

Cybersecurity vulnerabilities persist even a decade after reserve theft

❐ Staff Reporter

---

Nearly a decade after the Bangladesh Bank reserve theft, the country’s central bank’s international financial transaction system remains at serious security risk. The report of the committee formed to investigate the reserve theft incident has revealed that despite some security improvements, international-standard IT security has not yet been ensured.

At the same time, the Criminal Investigation Department (CID) of the police has prepared charge sheets against 64 individuals and organizations from six countries in the reserve theft case. The accused include former Bangladesh Bank Governor Dr. Atiur Rahman and 10 Bangladeshi officials.

On February 4, 2016, approximately $101 million was stolen from Bangladesh Bank’s foreign exchange reserves at the Federal Reserve Bank of New York. The hackers used SWIFT, an international banking messaging platform, to transfer the funds.

A $20 million transaction sent to Sri Lanka was blocked due to a typographical error, but the remaining $81 million arrived in four fake accounts at Rizal Commercial Bank in Makati City, Philippines.

After the incident, Bangladesh Bank filed a case with Motijheel Police Station on March 3, 2016. The CID is in charge of the lengthy investigation.

In July last year, an investigation committee formed during the interim government reviewed Bangladesh Bank’s cybersecurity measures.

The committee report said that some of the software used in the central bank does not meet the highest international security standards. The tendency to buy software from the lowest bidder is creating major security risks. Therefore, it has been recommended to prioritize security standards over cost.

The report also noted that several important security measures are still being implemented in a general framework, which is not sufficient for a sensitive institution like Bangladesh Bank.

Unless security systems are customized for the organization, weaknesses in detecting and preventing cyber attacks will remain. During the inspection, some modern security devices were not found to be fully operational.

The investigation team also expressed concerns about the infrastructure risks. Multiple servers were placed near the server room without separate temperature controls. In addition, the server room is narrow, which poses a risk of major damage in the event of fire or excessive temperature.

More worryingly, there is a food heating system and a small kitchen next to the server room. The investigation report said that food waste could lead to a rat infestation, which could damage the fiber optic or data transmission cables.

Bangladesh Bank officials also admitted to the inquiry committee about the shortage of skilled IT and cybersecurity experts. The report recommended increasing manpower in this sector.

The report also found that if the main data center is down, it takes at least two hours to start the alternate data center. The investigation team believes this is a major risk in an emergency situation.

Recommendations include AI-based surveillance, regular risk assessments, the use of advanced security tools, controls on external device and mobile usage, and the introduction of user behavior monitoring systems.

Bangladesh Bank spokesperson Arif Hossain Khan said that several security measures have been taken after the hacking incident and efforts are being made to implement the recommendations of the investigation committee. However, there are limitations on purchasing software due to the government procurement process.

On the other hand, the charge sheet in the case has accused a total of 64 individuals and entities from Bangladesh, the Philippines, Sri Lanka, India, China, Japan and North Korea. The nearly 10,000-page charge sheet details the theft, transfer and laundering of money.

The charge sheet accuses Dr. Atiur Rahman of dereliction of duty, concealment of the incident, security failure and attempt to destroy evidence. Other Bangladeshi officials are also accused of dereliction of duty and failure to supervise.

North Korean national Park Jin Hyok has been identified as one of the masterminds. He is accused of infiltrating Bangladesh Bank’s network, conducting cyberattacks, and implementing money laundering operations. North Korean hacker organization Lazarus Group has also been indicted.

Investigating officers claim that there was pressure from various quarters during the investigation, especially to exclude the names of Bangladeshi individuals. However, the charge sheet has been finalized based on forensic information, international reports, and related documents.

Al Mamun, Additional Special Police Superintendent of the CID’s Financial Crime Unit, said the charge sheet has been sent to the Attorney General’s Office for legal opinion and will be submitted to the court soon.

Even a decade after the reserve theft, the most important message of the investigation report is the same – serious weaknesses still remain in Bangladesh Bank’s international transaction system, which cannot be ruled out if the risk of larger cyber attacks in the future is not resolved quickly.