Rebooting the Carbon Spot Market

Victims of the infostealer.Nimkey Trojan virus might have provided hackers with the necessary digital certificates and private electronic keys that temporarily shut down the spot carbon trading market in Europe this week.

After a rash of hacks of several national registries, including those in Austria, the Czech Republic, Germany and Romania, Commission officials estimate that about 2 million European Union allowances (EUAs), or 0.02 percent of EUAs in circulation, had been illegally transferred.

As a result, the Commission shut down the spot carbon trading market by preventing external or internal transfers of EUAs. Futures-based trading of EUAs, which represents about 80 percent of the carbon trading market, remains unaffected.

In the meantime, the Commission is in discussions with various national registries on how to improve security and set new standards. Once the national registries meet the new agreed security standards, they will be allowed to resume EUA transfers.

I doubt that the writers of Nimkey actually planned to shut down the carbon spot market. It's more likely that they went through their treasure trove of collected private keys and certificates and realized they had access to the various national registries—it was a crime of opportunity rather than a premeditated one.

However, it should be an object lesson for the rest of the markets when it comes to maintaining security of their networks. While digital certificates provide a decent level of security, Nimkey demonstrates their weakness. I would not be surprised if the Commission insists on not only password- and certificate-based security in the future, but on some token-based offering as well.

The major question now is whether to build the new systems themselves or move to an existing financial intranet that already provides that level of security and the clock is ticking. The longer the spot market remains closed, the more costly it will be to the industry. Yet, important decisions made in haste tend to be more expensive. I do not envy the Commission on this decision.