Arias-Barrera on Hacking the Financial Order: Mr. Robot, Financial Data as Critical Infrastructure and the Limits of Resolution Law

Ligia Catherine Arias-Barrera, Eternado de Colombia University, has published Hacking the Financial Order: Mr. Robot, Financial Data as Critical Infrastructure and the Limits of Resolution Law. Here is the abstract.

This article examines Mr. Robot as a cultural legal text through which a central problem of contemporary financial regulation becomes visible: the systemic significance of financial data. It asks how financial law should conceptualise and govern the loss, corruption or destruction of records that constitute, evidence and administer financial obligations. The article argues that existing recovery, resolution, operational resilience and data governance frameworks remain principally institution centred. Even where they address cloud concentration, outsourcing and critical third-party risk, they generally assume that the financial institution, its records and the evidentiary basis of its obligations remain sufficiently available during a crisis to permit orderly intervention. Using cultural legal studies and formal adaptation analysis, the article reads E Corp and the 5/9 hack as a regulatory thought experiment. The series condenses within a single fictional institution the concentration of consumer credit, data extraction, technological infrastructure, private currency and political authority. Its central event demonstrates that the destruction of financial records is not simply an operational disruption. It compromises the capacity to identify claims, establish liabilities, protect consumers, supervise markets and resolve failing institutions. The article consequently develops the concept of financial data as critical infrastructure, understood functionally as data whose loss, corruption or unavailability would impair the continued administration of financial obligations or the stability of the financial system. The article concludes that financial regulation should identify and govern critical financial records according to their systemic function. This requires more than conventional cybersecurity or data protection obligations. It requires independently verifiable replication, tested recoverability across jurisdictions, effective supervisory access, clear responsibility among financial firms and technology providers, and governance arrangements capable of preventing private actors from becoming exclusive evidentiary points of failure in financial markets.

Download the article from SSRN at the link.