Ransomware attack on critical pipeline fuels worry of transport chaos

The last 12 months has highlighted the importance of supply chain resilience.

That was seen, early in the COVID-19 pandemic, in the difficulty involved in obtaining personal protective equipment and, more recently, the disruption to deliveries of numerous goods caused by the stranding of the container ship Ever Given in the Suez Canal.

It has been highlighted again this weekend with news that the operators of Colonial, the single most important pipeline in the US, have been forced to close it following a ransomware attack.

The attack did not, on its own, cause the shutdown. That was something the pipeline’s managers did in response to the attack which, according to US media reports, may have been caused by a criminal organisation dubbed DarkSide that targets English-speaking countries and which is believed to operate out of one of the former Soviet republics.

The body is known to be highly professional in its organisation to the extent that it even has a help desk to facilitate ransom payments.

The US has an estimated 2.5 million miles of pipelines but Colonial is by far the most important.

It runs for 5,500 miles and it moves more than 2.5 million barrels of refined products such as gasoline, diesel and kerosene – around 45% of the average – used in the US daily.

Those fuels are transported from Houston and Louisiana and taken up America’s east coast to 14 states, including Virginia, New York and New Jersey, which are home to 50 million Americans. It serves more than a dozen leading US airports, including Hartsfield Jackson airport in Atlanta, Georgia, until last year the world’s busiest in terms of passenger traffic. It also supplies the US military.

Colonial is owned by five businesses including the private equity firm KKR; the Australian pension fund manager IFM; the Canadian pension fund manager Caisse de Depot et Placement du Quebec (CDPQ); Shell Midstream, part of Royal Dutch Shell and the asset management firm Koch Capital.

It is not unusual for the pipeline to suffer from outages. It has done so on 30 occasions during the last two decades, usually due to weather-related causes, such as Hurricane Katrina in 2005, Superstorm Sandy in 2012 and Hurricane Harvey in 2017.

The big question for the industry and its customers, though, is how long the pipeline will be down. The outage comes just ahead of the US summer driving season, the period between Memorial Day and Labor Day (this year between 31 May and 6 September) when millions of Americans take to their cars, during which demand for gasoline peaks.

US gasoline inventories have been built up ahead of this period of peak demand but, should the outage extend into a week or more, pump prices in the US are likely to rise. Gasoline prices on financial markets have already risen on the news – as has the price of Brent crude.

The seriousness of the situation is such that the Biden administration, which has already asked the operators of the US power networks to increase their resilience to potential cyber attacks, has become involved.

The Federal Energy Regulatory Commission is said to be helping out while Gina Raimondo, the US commerce secretary, unveiled emergency measures on Sunday to help facilitate deliveries of refined products.

The White House has said it is also working to avoid disruptions to supply and to help Colonial restore its pipeline operations as quickly as possible. There has even been speculation that the Marine Administration, part of the US Department of Transport, may have to issue waivers of the Jones Act, dating back to 1920, which requires all goods being moved between US ports, to be transported using ships which were built in the US and which are crewed by Americans.

Amrita Sen, of Energy Aspects, warned that while the crisis was expected to be resolved in three to four days, there could be a kneejerk reaction in the price of refined products if it dragged on.

She told Sky News: “If this goes on for longer then, ahead of the driving season, we should see a substantial jump in retail prices.

“[The] gasoline [market] is tight – it’s not crazy tight but, particularly on the eastern coast southern part, gasoline inventories are over five million barrels lower year on year.

“And, given personal incomes have risen back to pre-COVID levels very, very quickly in March, we are expecting a strong driving season.”

She said the price of diesel could jump by more than gasoline because diesel imports into the US east coast had been quite low during recent weeks.

Ms Sen also warned that, should tankers be diverted to the US, there could be shortages elsewhere, but said this could provide a respite to European refiners, who have been grappling for some time with over-capacity.

She said the fact that many Americans were still working from home would also act as a buffer against higher prices.

She added: “Demand is still recovering – we’re nowhere close to pre-COVID levels. But if this were to happen in a month or two’s time, when it is peak driving season, the impact would be material and you would see a huge spike in prices.”

Reuters reported that at least half a dozen tankers have been booked to ship gasoline from Europe to the US – with freight rates rising accordingly.

But questions are being asked why the industry was not in a better state to prepare for a situation like this. The sheer number of valves and sensors on US oil refineries and pipelines have long made them an attractive target to cyber attackers even though, in some cases, the kit is so old it is not operated via the internet.

The Wall Street Journal pointed out that, as long ago as 2016, a cybersecurity unit of US Homeland Security said it had identified and mitigated 186 vulnerabilities in the energy sector. Federal officials warned two years later that hackers working for Russia had been able to infiltrate control rooms of some US electric utilities.

Ms Sen said cyber-security spending would have to increase around the world to improve the resilience of oil pipelines and refineries to cyber-attacks.

She went on: “Cyber security spending will have to go up around the world – you’re just getting a taste [here] of very similar things that have been occurring and more will occur down the line.

“People are complacent until this actually hits them – and you will see quite significant tightening in terms of rules and more protection.

“It is fair to ask the question – this was expected or this was long-coming, so why wasn’t more done about it?”

Read Entire Article