Cybersecurity Policy Responses to the Colonial Pipeline Ransomware Attack (2024)

Long lines for gas and skyrocketing retail gas prices marked May 2021 as a memorable month for automobile owners. While gasoline shortages in the early 1970s were caused by an international oil embargo, this more recent supply shortfall resulted from a cyber ransomware attack on the Colonial Pipeline. Colonial Pipeline, the largest pipeline for transporting refined petroleum products in the United States, originates at refineries near Houston and extends some 5,500 miles to the New York City area. A hacker group known as DarkSide interrupted Colonial Pipeline’s access to its servers and demanded compensation.[1] The attack shut down Colonial Pipeline’s operations for approximately five days, causing localized shortages of gasoline, diesel fuel, and jet fuel.[2] Panic-buying became rampant across the southeastern United States as consumers feared gas would run out.[3]

Cyberthreats are becoming increasingly prevalent across all economic sectors, and they pose cascading national security risks for the energy industry. The Colonial Pipeline attack could have gone further. For instance, the infamous Russian NotPetya attack brought down most of Ukraine’s operating systems by infiltrating computers via a common accounting software mechanism and wiping information.[4] The NotPetya attack caused approximately $10 billion in damages spread across multiple international industries and crippled the country’s infrastructure.[5] Cyberattacks are increasingly utilized as a tactic in war for critical targets, as also seen in the numerous attacks on Ukraine’s energy infrastructure as an aspect of its current war with Russia.[6]

Following the high-profile Colonial Pipeline attack, federal and state governmental agencies undertook a series of actions to secure both the oil and gas pipeline networks and the electric grid. However, these complex components of critical infrastructure face continuing cybersecurity challenges.

The pipeline network was vulnerable to attack due to the government’s hands-off approach to cybersecurity, which left implementation largely up to private sector entities themselves.[7] The Transportation Security Administration (TSA) had suggested voluntary best practices standards to pipeline companies, but even physical security assessments had no enforcement capability.[8] In the electric sector, a Government Accountability Office report published just months before the Colonial Pipeline attack urged the Department of Energy (DOE) to address cybersecurity risks more strenuously, reflecting fears concerning vulnerabilities.[9]

This concern materialized in DarkSide’s ransomware attack, which was perpetrated by infiltrating Colonial Pipeline’s computer systems and encrypting billing files.[10] Colonial Pipeline controls nearly half of the gasoline, jet fuel, and diesel flowing along the East Coast.[11] Colonial Pipeline shut down its operational technology systems out of caution to halt further infection, but eventually paid the hackers $4.4 million in cryptocurrency to restore its operating systems.[12] Even after receiving the decryption key, it took days of work to restart the pipeline.[13] Federal authorities were eventually able to recover $2.3 million of the ransom.[14] Panic-buying by consumers depleted gasoline supplies at some service stations on the East Coast while also driving up retail gasoline prices.[15]

Alternatives to the pipeline, in the form of transporting fuel through trucks and tanker cars for trains, were slow to organize.[16] The Biden administration issued a temporary waiver for certain states to use noncompliant fuel to boost supply, and relaxed regulations covering transportation weight limits and personnel working hours.[17] This high-visibility incident led to widespread calls for remedial action as “every fragility was exposed.”[18] Whereas previous cybersecurity-focused action was based around presidential decrees, this event galvanized Congress and the Executive Branch into action. State regulators were also motivated to act due to the underlying dangers demonstrated by the Colonial Pipeline attack and the chaos it created, akin to a cybersecurity “Pearl Harbor” moment.[19] These responses included President Biden’s Executive Order 14,028 on Improving the Nation’s Cybersecurity, the Bipartisan Infrastructure Law, Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, and the TSA/Department of Homeland Security (DHS) Cybersecurity Directive.

Within a week of the attack, President Biden published an executive order that had initially been drafted in response to an earlier ransomware attack called SolarWinds.[20] Executive Order 14,028 is aimed at improving the protection of supply chain security by removing information barriers between the government and the private sector, establishing a Cyber Safety Review Board, and creating a playbook for responding to cybersecurity vulnerabilities and incidents.[21] It is also directed at improving federal government and contractor security, such as creating an expectation for enhanced cybersecurity through vendor assessments.[22] The White House subsequently declared November 2022 as Critical Infrastructure Security and Resilience Month.[23] The White House also subsequently issued a memorandum entitled “What We Urge You to Do to Protect Against the Threat of Ransomware” that suggested voluntary guidelines for private entities to follow to guard against ransomware.[24]

The Bipartisan Infrastructure Law is far-ranging in terms of providing financial programs and grants.[25] It established a Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance (RMUC) program that focuses on owners and operators of rural, municipal, and small electric facilities.[26] The State and Local Cybersecurity Grant Program is designated as state funding that directly funds cyber risks and threats as well as eligible uses for cybersecurity. The State Energy Program focuses on energy security, initiatives, and affordability as well as research programs under DOE and DHS for cybersecurity. Importantly, it also established a Cyber Response and Recovery Fund for the Cybersecurity and Infrastructure Security Agency (CISA) to use after an attack. Finally, the Energy Sector Operational Support for Cyber Resilience Program enhances and tests the emergency response capabilities of DOE.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 builds on Presidential Policy Directive 21 through required reporting to CISA within seventy-two hours for “cyber incidents that are likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States” and within “24 hours for ransom payments” actually paid out by the private entity.[27] The final requirements are to be promulgated through rule-making under CISA.[28]

The TSA/DHS Cybersecurity Directive focuses on critical infrastructure with performance-based standards. CISA also released performance goals across sectors focused on preventing further cybersecurity incidents.[29] Agency responses in the oil pipeline realm consisted of the issuance of TSA’s binding directives SD-01 and SD-02. SD-01 is an information-sharing directive mandating production of reports concerning cybersecurity incidents to CISA, designation of a cybersecurity coordinator, and reporting any deviations from TSA’s cybersecurity recommendations. SD-02 sets forth TSA’s substantive cybersecurity recommendations and requires mitigation measures, contingency and response plans, and third-party audits of cybersecurity practices.[30] These emergency directions will only last a year before needing renewal.[31]

State responses to cybersecurity threats focused on analyzing emerging cyber threats to energy systems within their borders and improving their ability to respond to such threats. Approximately forty-six separate pieces of legislation were introduced regarding potential cybersecurity threats to energy infrastructure in 2021.[32] Utah and Colorado enacted legislation regarding state agency protection of critical infrastructure, and Utah created a Cybersecurity Commission to identify cybersecurity threats to the energy sector.[33] The New York Power Authority, the nation’s largest public power organization, contracted with a private cybersecurity firm to bolster its cyber security defenses.[34]