Colonial Pipeline Restarts Operations After Cyberattack On Fuel Supply Lines

Colonial Pipeline has restarted operations after a cybersecurity attack late last week forced the 5,500-mile privately owned pipeline system to temporarily shut down, affecting the national fuel supply. 

Colonial, which is the biggest fuel pipeline operator in the United States, said that it began the restart about 5 p.m. EDT on Wednesday. Energy Secretary Jennifer Granholm first announced the restoration on Twitter, saying she had just spoken to Colonial’s CEO about the decision.

“Following this restart, it will take several days for the product delivery supply chain to return to normal,” Colonial said in a statement. “Some markets served by Colonial Pipeline may experience, or continue to experience, intermittent service interruptions during the start-up period. Colonial will move as much gasoline, diesel, and jet fuel as is safely possible and will continue to do so until markets return to normal.”

Last Friday, an international criminal gang known as DarkSide carried out a ransomware attack on Colonial Pipeline. In such an attack, hackers infiltrate a network and encrypt important data, offering to give back control to the owners only if they pay a ransom. It’s unclear how much of Colonial’s network was infected. However, the company said it “proactively took certain systems offline to contain the threat.”

The pipeline system runs from the Texas Gulf Coast to the New York metropolitan area, and it transports more than 100 million gallons of fuel a day ― about 45% of the fuel consumed on the East Coast, according to the Georgia-based company. Government officials at all levels waived safety and environmental rules in order to speed the delivery of fuel to drivers and airports while Colonial faced its days-long attack.

The White House and members of President Joe Biden’s Cabinet have said that consumers may feel a supply crunch while Colonial works to resume operations but assured the public that there is no need to panic. However, more than 1,000 gas stations in the Southeast reported running out of fuel, mostly because of what analysts said has been unwarranted hoarding of gasoline by drivers. 

The company did not say whether it has or will pay the ransom. When asked about it, the White House said questions about such a decision are meant for Colonial to answer. However, the FBI advises against paying a ransom.

On the same day that Colonial initiated its restoration, Biden signed an executive order targeting national cybersecurity. The order is meant to protect federal networks, improve information-sharing between the government and the private sector on cyber issues, and strengthen the federal government’s ability to respond to cyberattacks. The requirements apply to the federal government and companies who contract with it.

The executive order gives Congress the opportunity to take some of the information-sharing and breach-reporting requirements Biden just authorized and apply them to a broader set of private companies, especially those like Colonial that affect critical infrastructure, according to a senior administration official. As of Tuesday, Colonial had not shared information about its breach with the Cybersecurity and Infrastructure Security Agency. The federal agency said at the time of the attack, though, that it was “engaged with the company and our interagency partners regarding the situation.”

When asked what kind of steps the federal government would take to encourage private companies to tighten cybersecurity to prevent attacks, White House press secretary Jen Psaki said, “That is out of our hands.”

“I would say that one of the reasons that we have stood up … and elevated a public-private coordinating apparatus or effort to work with the private sector is because we want to ensure that well-intentioned companies understand what they need to put in place and understand the risks that they’re facing,” Psaki said.

“Because we know, as this is an example of, that it won’t just impact that company, that it can impact ― depending on the entity ― the American public.”

But some energy regulators and policymakers said that it doesn’t make sense that the country’s almost 2 million miles of oil and gas pipelines are able to largely avoid federal cybersecurity oversight, unlike the electric grid that is overseen by the Federal Energy Regulatory Commission.

“Simply encouraging pipelines to voluntarily adopt best practices is an inadequate response to the ever-increasing number and sophistication of malevolent cyber actors,” FERC Chairman Richard Glick said in a statement. “Mandatory pipeline security standards are necessary to protect the infrastructure on which we all depend.”

Glick called on Congress this week to establish such mandatory cybersecurity standards. However, since the Colonial cyberattack, major fossil-fuel lobbyists, like the American Petroleum Institute, have tried to block such requirements for the country’s energy industry. 

Evergreen Action, a climate policy group that advocates for clean energy, said Wednesday that the Colonial Pipeline situation shows why the country cannot give “corporate polluters” so much control.

“The industry’s response to the Colonial Pipeline shutdown is just the latest in a long string of reminders of why we cannot allow corporate polluters to set the agenda for our energy future,” Executive Director Jamal Raad said in a statement. “Earlier this year, when an avoidable winter blackout caused by failing fossil fuel infrastructure resulted in dozens of deaths and millions of Texans losing power, the oil and gas industry and their cronies in Washington tried to deflect blame by spreading lies and misinformation.

“The pattern is clear: fossil fuel corporations can’t be relied on to deliver the resilient and reliable energy infrastructure we need. We don’t have to remain captive to the poisonous whims of the fossil fuel industry.”