Even the largest exchange can go dark

Graduate · enrolled learners

This lesson opens with The NYSE outage, 8 July 2015.

What happened

A software and configuration problem introduced during a gateway software upgrade caused the New York Stock Exchange to suspend all trading for about three and a half hours, one of the most prominent exchanges in the world going completely dark in the middle of a trading day. It happened to coincide with unrelated technology outages at an airline and a major newspaper, which fueled rumors of a coordinated cyberattack, but investigators confirmed it was an internal technical issue, not an attack. Crucially, the wider market kept functioning: because trading in NYSE-listed stocks also happens on other venues, orders simply routed elsewhere, and prices continued to be discovered while the NYSE itself was down. The exchange's size and reputation did not make it immune to a full outage; a routine upgrade gone wrong took the whole venue offline. What kept the outage from being a market-wide catastrophe was not the NYSE's robustness but the fact that no one had to depend on the NYSE alone, so its going dark was survivable for participants who could trade elsewhere.

The decision point

Even the largest and most reputable exchange can go completely offline, from something as ordinary as a routine software upgrade gone wrong, so a system that treats a big venue as too important or too robust to fail is trusting a size that does not confer immunity. The NYSE outage is the case: one of the world's most prominent exchanges went fully dark for about three and a half hours from an internal technical issue, not a cyberattack, and its size did nothing to prevent it. But the outage was survivable for the market for a specific reason: trading in NYSE-listed stocks was not concentrated on the NYSE, so orders routed to other venues and price discovery continued, which is the real lesson. The difference between the NYSE outage being a survivable event and being a catastrophe was redundancy, the existence of other venues to trade on, so a participant who could reach elsewhere kept trading, while a participant depending solely on the NYSE was stopped cold. This is the constructive counterpart to the course's venue-failure lessons: since any venue, however large, can go dark, the protection is not to find a venue that never fails but to avoid depending on a single venue whose failure stops the whole strategy, and to have a plan for a dark venue that does not require that venue. So the discipline is to treat single-venue dependence as fragile regardless of the venue's size, to prefer redundancy across venues where the stakes justify it, and, where a strategy genuinely must use one venue, to have defined safe behavior for that venue going dark. The NYSE outage is what a large venue going fully offline looks like, and its lesson is the hopeful one of the course: a venue's failure is survivable when you did not depend on it alone.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.