Biden administration scrambles to avoid shortages after Colonial Pipeline targeted in worst-ever attack on US infrastructure.
Last modified on Monday, 2021 May 10
The federal transport department issued an emergency declaration on Sunday to relax regulations for drivers carrying gasoline, diesel, jet fuel and other refined petroleum products in 17 states and the District of Columbia. It lets them work extra or more flexible hours to make up for any fuel shortage related to the pipeline outage.
Experts said on Sunday that gasoline prices were unlikely to be affected if the pipeline was back to normal in the next few days but that the incident should serve as a wake-up call to companies about the vulnerabilities they face.
It was hit by what Colonial called a ransomware attack, in which hackers typically lock up computer systems by encrypting data, paralyzing networks, and then demand a large ransom to unscramble it.
On Sunday, Colonial Pipeline said it was actively in the process of restoring some of its IT systems. It said it remains in contact with law enforcement and other federal agencies, including the energy department, which is leading the federal government response.
The company has not said what was demanded or who made the demand.
However, two people close to the investigation, speaking on condition of anonymity, identified the culprit as DarkSide. It is among ransomware gangs that have “professionalized” a criminal industry that has cost western nations tens of billions of dollars in losses in the past three years.
DarkSide claims that it does not attack hospitals and nursing homes, educational or government targets and that it donates a portion of its take to charity. It has been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations.
Colonial did not say whether it has paid or was negotiating a ransom, and DarkSide did not announce the attack on its dark website. The lack of acknowledgment usually indicates a victim is either negotiating or has paid.
On Sunday, Colonial Pipeline said it was developing a “system restart” plan. It said its main pipeline remains offline but some smaller lines are now operational.
“We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations,” the company said in a statement.
Colonial transports gasoline, diesel, jet fuel and home heating oil from refineries on the Gulf coast through pipelines running from Texas to New Jersey. Its pipeline system spans more than 5,500 miles (8,850km), transporting more than 100m gallons (380m litres) a day.
Debnil Chowdhury at the research firm IHSMarkit said that if the outage stretched to one to three weeks, gas prices could begin to rise.
“I wouldn’t be surprised, if this ends up being an outage of that magnitude, if we see 15- to 20-cent rise in gas prices over next week or two,” he said.
Gina Raimondo, commerce secretary, said on Sunday that ransomware attacks were “what businesses now have to worry about,” and that she would work “very vigorously” with homeland security officials to address the problem, calling it a top priority for the administration.
“Unfortunately, these sorts of attacks are becoming more frequent,” she said on CBS’ Face the Nation. “We have to work in partnership with business to secure networks to defend ourselves against these attacks.”
She said president Joe Biden was briefed on the attack.
“It’s an all-hands-on-deck effort right now,” Raimondo said. “And we are working closely with the company, state and local officials to make sure that they get back up to normal operations as quickly as possible and there aren’t disruptions in supply.”
One of the people close to the Colonial investigation said that the attackers also stole data from the company. Sometimes stolen data is more valuable to ransomware criminals than the leverage they gain by crippling a network, because some victims are loath to see sensitive information of theirs dumped online.
Ed Amoroso, boss of security firm TAG Cyber, said Colonial was lucky its attacker was at least ostensibly motivated only by profit, not geopolitics. State-backed hackers bent on more serious destruction use the same intrusion methods as ransomware gangs.
“For companies vulnerable to ransomware, it’s a bad sign because they are probably more vulnerable to more serious attacks,” he said. Russian cyberwarriors, for example, crippled the electrical grid in Ukraine during the winters of 2015 and 2016.
In the US, attacks have forced delays in cancer treatment at hospitals, interrupted schooling and paralyzed police and city governments. Tulsa this week became the 32nd state or local government in the U.S. to come under ransomware attack, said Brett Callow, a threat analyst with the cybersecurity firm Emsisoft.
… we have a small favor to ask. Across the US and around the world, millions rely on the Guardian for independent journalism that stands for truth and integrity. The Guardian has no shareholders or billionaire owner to please, and we invest every penny we earn back into our journalism. Readers chose to support us financially more than 1.5 million times in 2020, joining existing supporters in 180 countries.
With your help, we will continue to provide high-impact reporting that can counter misinformation and offer an authoritative, trustworthy source of news for everyone. With no shareholders or billionaire owner, we set our own agenda and provide truth-seeking journalism that’s free from commercial and political influence. When it’s never mattered more, we can investigate and challenge without fear or favor.
Unlike many others, we have maintained our choice: to keep Guardian journalism open for all readers, regardless of where they live or what they can afford to pay. We do this because we believe in information equality, where everyone deserves to read accurate news and thoughtful analysis. Greater numbers of people are staying well-informed on world events, and being inspired to take meaningful action.
We aim to offer readers a comprehensive, international perspective on critical events shaping our world – from the Black Lives Matter movement, to the new American administration, Brexit, and the world’s slow emergence from a global pandemic. We are committed to upholding our reputation for urgent, powerful reporting on the climate emergency, and made the decision to reject advertising from fossil fuel companies, divest from the oil and gas industries, and set a course to achieve net zero emissions by 2030.
If there were ever a time to join us, it is now. Every contribution, however big or small, powers our journalism and helps sustain our future. Support the Guardian from as little as $1 – and it only takes a minute. Thank you.