The forensic team has completed its analysis of the financial computing software for First National Bank. Our findings indicate that "siphoning" (or "skimming") was occurring.
The software takes a list of 10,000 credit transactions and 10,000 debit transactions and calculates the net balance
However, the calculations were carried out using the IEEE single-precision floating-point number system, which maintains approximately 8 significant digits.
The net was computed by the software using 3 different methods.
Method A simply calculates the sum of the credits, and subtracts from it the sum of the debits.
Method B calculates the sum of the credits, and then subtracts the debits, one at a time, from smallest in size to the largest.
Method C sorts both the credits and debits, from smallest in size to largest, and incorporates them into the net in credit/debit pairs, starting with the smallest.
Finally, the program returns the minimum of the 3 values.
Mathematically, these three methods are equivalent. However, they can result in drastic differences when round-off error is present.
Our analysis indicates that Method C is the most accurate because it results in much smaller intermediate values. Using Method A or B, intermediate values can be larger in size than $100,000,000, which means the round-off error (for IEEE single-precision) would be around the "tens" digit. These round-off errors can accumulate.
Since the function returns the minimum of the three methods, we conclude that the author of the code intended the software to under-report the net value of the calculation, and "skim" the unreported dollars into their own bank account.
No comments:
Post a Comment