Colonial Pipeline Cyber Attack Points To Larger Security Concerns

The ongoing closure of the key Colonial Pipeline due to a cyber attack produced two fairly amusing developments on Monday:

First, the cyber terrorist group accused by the federal government of executing the attack initially tried to deflect blame to an offshoot group of cyber terrorists – sort of a subsidiary, apparently. Later, the group said it never thought Colonial would shut in the line and disrupt gasoline flowing all along the Atlantic seaboard, and promised that, in the future, its cyber terrorism efforts would be limited to “less controversial” targets. As if any of that obfuscation makes any of this any better at all.

Second, an online sports bookie that will not be named here is now offering betting props on things like:

• When will Colonial Pipeline service be renewed? Current over/under: May 15.
• Will the average price per gallon for regular gas be above $3.50 by July 4?
• Will the average price per gallon in New York City be above $4.00 at some point during 2021?

Those amusing anecdotes notwithstanding, this attack on a pipeline that supplies up to 45% of daily automobile fuel needs to more than 50 million Americans is really not a laughing matter. The focus on the event by the Biden administration – with President Biden himself commenting on it and the Department of Transportation (DOT) declaring a state of emergency in 17 impacted states – highlights the importance of critical oil and gas-related infrastructure to U.S. national security.

When I contacted Tufts University Prof. Rockford Weiss, Director of the Fletcher Maritime Studies Program, to get his views, he said “The Colonial Pipeline cyber attack should be a wakeup call on Capitol Hill. We need to think holistically about security threats against America’s energy infrastructure — and implement smart policies that will reduce security threats across the entire energy system.”

Weiss pointed to the weakness in current U.S. cyber-crime law, noting that “It is even unclear whether nation-states can be successful in punishment for cyber attacks, or deterrence. The U.S. has arraigned many foreign actors for cyber crime, but none of them have done time in jail.”

Both Weitz and Bloomberg Intelligence Analyst Michael Kay suggested that the federal government should consider suspending the provisions of the Jones Act, which restricts movements of any products from one U.S. port to another U.S. port to ships manned by U.S. crews. Obviously, temporarily suspending those restrictions just as the DOT did for daily hourly driving limits on truck drivers would assist the Maritime industry in helping supply gas, diesel and home heating oil to the Atlantic seaboard if it becomes necessary. No one should doubt that price and supply impacts will take place – Bloomberg reported late Monday that some gas stations in the impacted region were already experiencing shortages, and that will inevitably lead to higher prices.

Should the outage of Colonial be resolved by the end of this week, as the company now indicates could be the case, easing the Jones Act could turn out to be unnecessary. As Bernadette Johnson, Senior Vice President of Power & Renewables at Enverus, said in an email, “The impact of this event is still unclear because there is no firm timeline for the restart of operations as of now. If this outage is relatively short term, there will likely be only a very short term spike in refined product prices in the northeast. Refined product storage in both the USGC and Northeast can largely mitigate the impact of a short term event.”

But, should the outage last for a longer term, Johnson adds that the negative impacts could expand from a regional issue to one that impacts every consumer in the Lower 48 states: “If this outage were to persist for a significant amount of time, there would be product shortfalls in the Northeast and a glut of product in the USGC, which would impact prices across the country,” she said.

Regardless of the level of impacts from this single event, Weitz notes that policymakers should take it as a wake-up call pointing to the need to take measures to beef-up security requirements of critical U.S. energy infrastructure. “What matters is defense,” he said. “This is a reminder that U.S. companies and networks can be attacked at any time with real world impacts.”

With luck, this isolated event related to Colonial Pipeline will be short-lived and only produce minor impacts. But luck is not a plan, and this attack on Colonial points up the longstanding need for better security planning across the entire U.S. energy supply chain.