DAS Rutherford began with a review of the fiscal situation noting that the economy posted a 2.8 percent growth rate in the fourth quarter of 2011. Rutherford presented a series of charts showing recent trends in receipts, outlays, and deficits. DAS Rutherford noted that the Administration’s new budget numbers are expected to be released in early February 2012.

Director Kim proceeded to discuss Treasury’s marketable debt portfolio. Using OMB deficit projections from the September 2011 report, “Living Within Our Means and Investing in the Future” and assuming no changes to the current issuance strategy, Treasury looks to be under financed in FY2012. With the same assumptions, Treasury would be over financed from FY2013 to FY2016. Any financing shortfalls in FY2012 are expected to be made up with increased bill issuance.

Director Kim next reviewed several debt metrics. As of December 30, the average maturity of the portfolio was approximately 62.4 months. In the chart presentation showing the projections for Treasury’s weighted average maturity, Director Kim adjusted future note and bond issuance on a pro-rata basis to match financing needs. The projections show that average maturity continues to extend.

Director Kim emphasized that the average maturity projections and the associated underlying assumptions for future issuance were hypothetical and not meant to convey future debt management policy or an average maturity target. He reiterated that Treasury will remain flexible in the conduct of debt management policy.

Director Kim then turned to demand characteristics within the primary market for Treasury securities. He noted that bid-to-cover ratios for TIPS auctions were at high levels across most maturity points. Director Kim noted that Treasury plans to gradually increase the size of TIPS issuance in 2012. This year, Treasury will issue approximately $150 billion of TIPS. The majority of the incremental new issuance will likely be at the 5- and 10-year tenors.

He also noted that bid-to-cover ratios remained at healthy levels for all Treasury securities, with particularly high demand for 4-week bills. The elevated bid-to-cover ratios in 4-week bill auctions in late December were related to the rule that bounds bill auction stop-out rates at zero. The question was asked if it made sense for Treasury to permit bids and awards at negative interest rates in marketable Treasury bill auctions. DAS Rutherford noted that there were operational issues associated with such a rule change, but that the hurdles were not insurmountable. It was the unanimous view of the committee that Treasury should modify auction regulations to permit negative rate bidding and awards in Treasury bill auctions as soon as feasible. Rutherford noted that any decision on this policy change would likely be made at the May refunding.

The Committee next turned to the question in the charge regarding Floating Rate Notes (FRNs).
Treasury continually seeks ways to minimize borrowing costs, better manage its liability profile, enhance market liquidity, and expand the investor base in Treasury securities. Market participants and the Committee have previously suggested that FRNs could help Treasury meet these objectives. Treasury asked the Committee to comment on the viability of such a product, along with the optimal maturity, reference index, reset frequency, payment period, and distribution mechanism. Treasury requested a specific recommendation for the structure of a Treasury FRN and for the Committee to help determine whether such a security would be additive to Treasury’s current mix of products.

The presenting member opened by discussing the demand backdrop for U.S. Treasuries, noting structural declines of high-quality assets over the last five years. Furthermore, regulatory changes could result in incremental Treasury demand. Additionally, money market funds may have demand for a Treasury FRN, especially if the final maturity were two years or less. The Committee member also noted that other short-end investors that are not constrained by money market fund regulations, such as securities lenders, municipalities, GSEs and corporations, would be a source of potential demand.

Turning next to the arguments in support of FRNs and the estimated benefits of Treasury issuing such securities, the presenting member revisited the case for extending the average maturity of Treasury’s debt portfolio. The Committee member stated that FRN issuance would reduce Treasury’s roll over burden. In addition, FRN issuance, in lieu of fixed-rate term issuance, would allow Treasury to avoid paying an interest rate risk premium. This product would allow the U.S. government to extend the maturity of its funding while reducing interest expense, depending on what securities would be replaced by FRN issuance.

The presenter discussed how the cost savings of FRNs would depend on the pricing spread versus the cost of maturity extension and the interest rate risk premium. The Committee member noted that the cost of maturity extension can be determined by using an asset swap spread of term Treasury debt over bills. In near-zero asymmetric rate regimes the member noted that interest rate risk premium can be approximated by observing the sum of at-the-money interest rate caplet costs for the tenor of the FRN.

Next, the presenting member discussed choices of reference indices and sample structures. The member noted that the majority of the floating rate securities issued by the GSEs are indexed to either LIBOR or the federal funds rate. The size of this market currently stands at $152 billion. Moreover, the majority of corporate FRNs are also linked to LIBOR. The presenter noted that LIBOR would be disadvantageous to Treasury as it would subject the government’s financing costs to bank funding risks.

The Committee member noted that issuance in the FRN market primarily occurred at maturities of 5-years and under. Additionally, the presenter stated that a higher reset frequency will result in shorter interest rate duration and lower price volatility. This characteristic may make the asset more attractive for stable-value buyers. The presenter went on to recommend that Treasury floor the coupons at zero.

In conclusion, the presenting member noted that the examination of alternative forms and structures of debt issuance is consistent with Treasury’s mission of financing the government at the lowest cost over time. It was suggested that Treasury begin by issuing a 2-year FRN with a floating rate index reset daily. This would appeal to both money market participants and investors looking for a stable-value asset.

An active discussion ensued. One member noted that FRNs would be a more cost effective way to extend maturity. Another member stressed the importance of this program becoming both large and liquid to appeal to a broad investor base. One member asked what distribution mechanism would best fit this issuance: an auction or a window. The discussion concluded with the Committee unanimously favoring FRN issuance, while noting that more work remains to be done to explore various structural considerations.

The meeting adjourned at 1:00 p.m.

The Committee reconvened at the Department of the Treasury at 6:00 p.m. All Committee members except Walter J. Muller and Stephen Rodosky were present. The Chairman presented the Committee report to Secretary Geithner.

A brief discussion followed the Chairman’s presentation but did not raise significant questions regarding the report’s content.

The Committee then reviewed the financing for the remainder of the January through March quarter (see attached).

The meeting adjourned at 6:30 p.m.

The reality is that cloud security is a real consideration across all industries – not just financial services – and must be a critical focus area when conducting due diligence on cloud infrastructures and cloud providers.  The Cloud Security Alliance recently released the third version of its “Security Guidance for Critical Areas of Focus in Cloud Computing” report, which delivers actionable best practices around cloud security.  The report is 177 pages, so consider this article a much abbreviated Cliffs Notes version to help frame your questions on cloud security for hedge fund environments.

Defense in depth is a security methodology long followed for on-premise infrastructures where layers of security (office building to desktop to server to firewall to router) help ward off threats and provide redundancy should one layer of protection fail or become compromised.  This strategy is also applicable to cloud infrastructures, with a key difference being the cloud includes virtual assets along with physical assets.

Physical Security

Physical security includes the data center facilities that house the cloud infrastructure as well as the physical network components.  The cloud should reside in a Tier III (or greater) class data center that is composed of multiple active power and cooling distribution paths as well as redundant components throughout.  Be sure to ask the cloud provider if the data center is in a region that could experience seismic activity, natural disasters (i.e. flooding) or other environmental threats that could disrupt service.

Beyond location, the cloud data center should be secured with practices including:

• 24x7x365 manned lobby with visual verification of identity
• Two-phase (card and biometric) authentication of visitors
• Secured entry points (doors and elevator banks), including sensors and cameras
• Monitored security cameras
• Visitor logs for cages, which are periodically reviewed and cross-checked
• Key-locked cages and cabinets

Isolation & Security

Virtualization is a core element of a cloud infrastructure and brings unique security considerations as traffic travels differently over virtual machines than it does with a traditional network.  A cloud provider should combine traditional network-based security controls alongside virtual machine security tools for an added layer of security.  In addition to security protocols, all network interfaces within the virtualized environment should be configured in a redundant manner, and the infrastructure should be backed up and replicated to multiple data centers to ensure resiliency and uptime.

Another often-voiced cloud security concern is that of data co-mingling across different clients.  A cloud must be architected in such a way that clients have secure, isolated environments for their data, resources and applications to reside.  It is critical that data be securely separated to eliminate the risk for cross-contamination of data or access to other client environments.  Consider asking a provider to explain their reporting mechanism for ensuring evidence of isolation and identifying a breach of isolation.

Finally, cloud providers should follow best practices for securing cloud inter-site transmissions and offer clients the option to encrypt sensitive messages in accordance with regulatory legislation including SOX, GLBA, PIPEDA and the European Union Data Directive.

Policies, Policies, Policies

As part of your due diligence, ask for specifics on your service provider’s security policies including:

• Access Control Policy: How is access to and control of the storage, virtualization and network infrastructures managed?  What protocols are in place for monitoring, granting access and logging changes to client information systems?
• Information Security Management Policy: What physical and virtual security safeguards does the provider have in place to protect against breaches?  How does the provider manage information security violations and incidents?  What are the procedures for incident reporting, resolution and corrective action?
• Employee, Visitor and Contractor Physical Security Policy: What practices are in place for monitoring employees, visitors and contractors while on premise (office or data center)?  What background verification, screening agreements and employment agreements are established?

Beyond reviewing the policies, inquire about how employees are trained on the policies and when the company last tested its internal policies.  It is worthwhile to request a summary of results to ensure a passing score was achieved and any identified vulnerabilities were addressed.

The Reality

Security threats exist in both traditional networks and cloud environments.  The reality is that either deployment scenario is only as strong as its weakest link.  The key is working with a provider that understands the unique security threats, looks at the infrastructure holistically and implements the appropriate safeguards to mitigate risks.

About the Author

Mary Beth Hamilton is director of marketing for Eze Castle Integration (www.eci.com), a leading provider of IT and cloud computing services, technology and consulting to hedge funds and alternative investment firms.  She has over a decade of technology and marketing experience and holds an MBA from Boston College.

Remember, in order to be registered by the deadline, you must file by February. If you haven’t already taken the steps necessary to protect your firm, you’re out of time.

Hedge fund compliance firm NRS has put together some tools to help your firm prepare for registration:

• The NRS Private Fund Registration and Compliance Intelligence Center, a collection of 15 insightful, easy-to-understand articles and how-tos designed to help your firm find its footing when it comes to registration tasks and strategies.

• Back by popular demand, a free Webinar entitled “Private Fund Registration and Compliance: What you need to know now”. Limited to the first 100 respondents, this online seminar is hosted by Mederic Daigneault, NRS’s Director of Hedge Fund Services, and will provide answers to frequently asked questions regarding registration requirements, timelines and the specifics of an ongoing compliance program.

NRS also recommends that you build your compliance program and complete registration documents now even if you don’t file until the 11th hour, avoiding the risk of operating as an unregistered investment adviser.

During the vendor evaluation process it is necessary to ask tough questions and evaluate the service provider in a number of areas including the cloud architecture, security policies, data protection safeguards and support delivery. The following questions provide a starting point.

Cloud Architecture, Experience & Support

• Does the service provider deliver dedicated or shared resources within the cloud? Will a client’s data be isolated from other clients who reside in the same cloud?
• Does the cloud provider own their own equipment?
• Is the cloud data center SAS 70 compliant?
• Which technology vendors have applications operating within the service provider’s cloud?
• What certification levels does the provider have with these application vendors?
• How are support requests handled, and what is the expected response time?
• What Service Level Agreements are in place for the cloud infrastructure?

Security Policies & Procedures

• What is your information security policy and how often is it reviewed?
• What security standards are used to ensure data and application integrity?
• Have you ever experienced a security breach? If so, how was it resolved and what safeguards were implemented to prevent a repeat experience?
• Is data encrypted at rest as well as in transit?
• What physical security elements are in place at the data center (i.e. locked cages and cabinets, cameras, access points, etc.)?
• When was your last network penetration test conducted and what did it involve?

Business Continuity & Disaster Recovery

• Does the cloud infrastructure feature an N+1 configuration to enable high availability?
• What are your backup and retention procedures? How long is data retained?
• What is your disaster recovery strategy and how frequently is it tested? What does the test encompass?
• Is there a plan for pandemic or mass absentee (up to 40%) situations?
• Are there provisions in place to recover work in progress at the time of an interruption?
• How much downtime (planned and unplanned) has your cloud experienced over the past 12, 24 and 36 months? How did the downtime impact clients?

About the Author
Mary Beth Hamilton is director of marketing for Eze Castle Integration (www.eci.com), a leading provider of IT and cloud computing services, technology and consulting to hedge funds and alternative investment firms. She has over a decade of technology and marketing experience and holds an MBA from Boston College.

The tale of hand-bag mogul, turned Azerbaijan oil-speculator, turned felon, Frederic Bourke came to an end in mid-December when the Second Circuit Court of Appeals sustained his conviction on conspiracy to violate the Foreign Corrupt Practices Act (“FCPA”) and other charges.  The next day the trial court denied Bourke’s motion for a new trial and ordered that he surrender himself to Federal Marshals on January 3, 2012 to begin serving a year and a day sentence in the federal penitentiary.

Bourke’s legal problem arose from a far-reaching private investment scheme designed to purchase and privatize the national oil company of Azerbaijan — SOCAR.  Though the focus of much of this case has been on Bourke and the leader of the investment scheme Viktor Kozeny — the so-called “Pirate of Prague” (who has, to date, fended off attempts extradite him from the Bahamas to the United States to face charges) –the case also touched the hedge fund world.  Clayton Lewis, a former partner at the Omega Advisors, Inc. hedge fund, pled guilty to FCPA charges arising from Omega’s investment in the scheme, but has yet to be sentenced as the Government still hopes to use him as a testifying witness against Kozeny if and when he is extradited.  Omega, for its part, avoided criminal prosecution, but did agree to a civil forfeiture of $500,000.

In upholding his conviction, the Court of Appeals found the trial court correctly informed the jury it could find Bourke guilty of conspiring to violate the FCPA if it believed he “consciously avoided” gaining knowledge of the corrupt scheme.  In rendering its decision, the Court emphasized that Bourke knew he was doing business in a country with a reputation for corruption (Azerbaijan) and that Kozeny — who was leading the investment syndicate — had a reputation for corrupt dealings (Kozeny).  This decision only reiterates the importance of conducting anti-corruption due diligence of potential business partners, especially on deals involving countries with a reputation for corruption.

While the scope and details of such due diligence efforts may necessarily vary from deal to deal, the basics can oftentimes be integrated into existing due diligence modules.  In general, due diligence efforts directed at potential partners should be focused on discerning the reputation of the investor and determining whether the potential-partner has any business or family ties with foreign government officials that could present FCPA risks.  This may include asking the potential partner to answer detailed questionnaires, vigorously checking business and credit references, checking the partner against U.S. government and international “blacklists”, and personal interviews between the hedge fund manager and key personnel of the potential partner.

The bottom line take-away from the travails of Frederic Bourke, Clayton Lewis, Omega Advisors and their dealings with the Pirate of Prague, is that the U.S. government expects sophisticated investors to know their partners and recognize the risks of investing in markets with a reputation for corruption.  The U.S. government and the courts have made clear that investors who fail to undertake robust due diligence or who knowingly chose to partner with unsavory advisors risk prosecution under the FCPA.

Miller & Chevalier is recognized as having one of the pre-eminent FCPA and international anti-corruption practices in the United States. For more than 20 years, our team has advised U.S. and non-U.S. businesses in every aspect of anti-corruption and FCPA issues. Since 2006, Miller & Chevalier lawyers have made more than 100 visits to over 35 different countries on five continents, including China, Russia, and several countries each in Africa, Latin America, the Middle East, and South East Asia, in connection with FCPA investigations and compliance assessments.

KILL THE MONSTER! Vote RON PAUL
FEED THE MONSTER! Vote OBAMA
CONVERT THE MONSTER! Vote ROMNEY
NEGOTIATE WITH THE MONSTER! Vote NEWT
OUTLAW MONSTERS! Vote BACHMANN
I HATE MONSTERS, TOO! Vote SANTORUM
WE EXECUTE MONSTERS IN TEXAS! Vote PERRY

• Quickly implement and use enterprise-grade technology systems and applications without employing a dedicated IT team;
• Outsource management and maintenance of technology to third-party experts responsible for ensuring continuous availability and high performance levels;
• Transition technology spending from capital expenditures to operating expenditures; and
• Easily scale technology environments to match business needs – eliminating the need to over or under buy when forecasting business growth.

When weighing adoption of cloud-services, it is important to understand the difference between cloud deployment models, namely public and private clouds.

• Public clouds are owned and operated by third-party service providers and benefit customers by delivering cost-savings derived from economies of scale. While competitively priced, public clouds aren’t always the best option for firms that require custom configurations and applications or desire high-touch service from support staff that understand the financial services market and associated technology.
• Private clouds are those that are built exclusively for an individual enterprise and can minimize concern around resource availability, security and resiliency. In the private cloud category, there are two flavors – on-premise and externally hosted.

An on-premise private cloud is generally known as an “internal cloud” that is hosted within an organization’s own data center. An externally hosted private cloud is, just as the name indicates, hosted and managed by an external cloud computing provider. Externally hosted private clouds are a popular choice for hedge funds as they allow for greater customization and flexibility while still providing compelling cost-savings.

Beyond the types of clouds, the cloud-based services market is frequently divided into three subcategories based on the services delivered. These categories are: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). Of these, IaaS and SaaS are gaining the greatest traction and interest in the hedge fund market.

• In the SaaS model, an application is hosted and managed by a vendor or service provider and made available to users via the Internet. Customers share all or part of an application but do not control the underlying platform or infrastructure.
• PaaS is the delivery of a computing platform via the cloud. The PaaS model enables hedge funds to build and test applications without incurring the cost and complexity of buying and managing the underlying software/hardware.
• IaaS provides computing resources without requiring a firm to purchase physical hardware such as storage, servers and networking equipment. Many IaaS providers bundle the infrastructure services with business applications, such as Microsoft Exchange and Office, to deliver a complete solution. With IaaS, customers can control processing power, networking components, the operating system, storage and deployed applications, but do not control the underlying physical infrastructure.

Cloud-based services aren’t right for every hedge fund, but the potential value delivered via the cloud makes it essential that firms become knowledgeable about their technology options.

About the Author
Mary Beth Hamilton is director of marketing for Eze Castle Integration (www.eci.com), a leading provider of IT and cloud computing services, technology and consulting to hedge funds and alternative investment firms. She has over a decade of technology and marketing experience and holds an MBA from Boston College.