Colonial pipeline restarted its massive underground fuel-moving system last night, putting the end in sight for a supply crunch that resulted from a major cyberattack and drained the fuel tanks of airports and gas stations from Alabama to Virginia.
But it’s not clear how soon the yellow "out of service" bags will be coming off gas pump handles in the South. Nor is it clear what the political repercussions will be for President Biden, whose critics sought to tie gas lines to his clean energy agenda. Biden issued an executive order last night to fortify federal digital defenses as lawmakers and other called for tougher cybersecurity rules (see related story).
It will take days, company officials and others warned, for the fuel system to get back to normal. Gasoline moves through pipelines at 3 to 5 mph. Even after it reaches terminals, industry officials warned that a shortage of truck drivers could slow deliveries.
Still, the news could quell the panic buying that drained stations across the Southeast.
It also takes pressure off Colonial Pipeline Co., a low-profile, high-volume system that fuels the travels of millions of people each day without most of them realizing it. Rarely in the spotlight, the Georgia-based company has communicated with the public mostly by unsigned statements posted online.
But the pressure on political and business leaders to do more to head off the effects of computer attacks will likely only increase now that the abstract concept of cybersecurity has hit people’s gas tanks and wallets.
Colonial was launched into the spotlight after a criminal hacking group called DarkSide took its computer files hostage Friday (Energywire, May 12).
The company’s closure of its 5,500-mile network suspended daily deliveries of 100 million gallons of jet fuel, gasoline and other fuels to the Southeast and East Coast. The system runs from Houston to New York, but shortages were most acute in Georgia, the Carolinas and southern Virginia.
More than two-thirds of the gas stations in North Carolina were out of gas last night, according to GasBuddy.com. Outages were reported at roughly half the stations in Georgia and Virginia. According to AAA, the average national gas price was a little more than $3 a gallon, the first time it has crossed that threshold since 2014.
In a statement posted shortly after 5 p.m. yesterday, Colonial said it had just restarted the system.
"Colonial will move as much gasoline, diesel, and jet fuel as is safely possible and will continue to do so until markets return to normal," the Alpharetta, Ga.-based company said in its statement.
Energy Secretary Jennifer Granholm tweeted the news at nearly the same time, saying she’d just gotten off the phone with Colonial CEO Joseph Blount.
Granholm late yesterday said there was "no need to panic."
"It’s coming to you, things will be back to normal," Granholm told Nexstar Media Group.
After reviewing its systems, Colonial "found that they were able to contain it," Granholm said in her interview with Nexstar. "They rebuilt their system, and they’re able to start it up again."
Biden, Trump and the Jones Act
Granholm has led the response for the Biden administration, which assumed a high-profile role in managing the situation Tuesday as lines of cars streamed out from gas stations.
Federal agencies had been moving to relax some rules to make more supplies available, but starting Tuesday the announcements were relayed from the White House, which arranged for three Cabinet secretaries to brief members at the Capitol last night.
White House press secretary Jen Psaki yesterday said Biden’s focus from the beginning was to "put every step in place that is possible."
The all-hands-on-deck approach came as Republicans — including former President Trump — sought to pin the blame for the gas shortages on the administration and its push for green energy.
From his home in Palm Beach, Fla., Trump yesterday bashed Biden’s handling of the fuel crunch in three emailed statements. He even worked it into his broadside at Rep. Liz Cheney (R-Wyo.), who was stripped of her House leadership post for opposing Trump’s false claim that he won the presidential election.
Republicans also sought to link the gas shortages to Biden’s decision to scrap a permit for the Keystone XL pipeline, seizing on Granholm’s remarks at the White House on Tuesday that pipelines are "the best way to go" to transport gasoline to the eastern United States.
Biden is less friendly to the oil industry than Trump, but the two pipeline situations are unrelated. The Keystone XL pipeline would have carried unrefined Canadian crude oil to the Gulf Coast. Colonial distributes petroleum products to East Coast markets.
Biden was also facing increasingly strident calls from industry to waive the Jones Act to lift some restrictions on domestic shipping. Such waivers are commonly opposed by unions, a key Biden constituency.
The hack put a spotlight on the security of U.S. pipelines and other critical infrastructure. The federal government is still dealing with fallout from several high-profile security breaches such as the Russian-linked SolarWinds Inc. cyberespionage campaign. But this breach was more than just an abstract news story to motorists.
It will raise more questions about relying on voluntary standards enforced by the Transportation Security Administration to keep hackers out of the systems that control the nation’s pipelines.
Lawmakers were already sounding alarms at the state of federal and private digital security. Now they’re turning up the volume and looking at potential changes to critical infrastructure cybersecurity policy to beef up defenses against criminal and nation-backed hackers.
Sen. Ron Wyden (D-Ore.) said in a statement yesterday that "many of the companies running our critical infrastructure have left their systems vulnerable to hackers through dangerously negligent cybersecurity. These corporate failures pose a severe threat to national security."
He called for civil and criminal penalties and personal accountability for top executives for lax cybersecurity. He said federal agencies should be conducting regular cybersecurity audits of companies.
Similarly, New York Rep. John Katko, the top Republican on the House Homeland Security Committee, requested an update from the Cybersecurity and Infrastructure Security Agency on partnerships among TSA, DOE and other stakeholders.
And the two Democrats on the Federal Energy Regulatory Commission, Allison Clements and Chairman Richard Glick, called for mandatory cybersecurity standards for gas, oil and hazardous liquid pipelines.
"It is time to establish mandatory pipeline cybersecurity standards similar to those applicable to the electricity sector. Simply encouraging pipelines to voluntarily adopt best practices is an inadequate response to the ever-increasing number and sophistication of malevolent cyber actors," they said in a statement.
New congressional incentives?
The ransomware attack — hackers encrypting victims’ computer files and demanding digital payment to unlock them — did not appear to touch Colonial’s operational technology systems, but the company said the pipeline was shut down out of an abundance of caution and an attempt to stop the spread.
As the pipeline restarted, Biden signed a long-expected executive order aimed at shoring up federal digital defenses in response to the recent cyberespionage campaigns. The executive order will require incident reporting and security requirements for federal contractors, among other security policies.
It doesn’t directly impact the critical infrastructure security, but a senior administration official said Biden’s team wants the order to "shape the software market using the power of federal procurement" that will better secure key sectors.
The Biden administration now expects to "double down" on key security efforts in critical infrastructure, the official said, such as the recent 100-day grid security plan.
Transportation Secretary Pete Buttigieg said the hack shows that U.S. facilities need to be better fortified against intrusion and suggested the administration’s infrastructure plan would require those seeking money to boost their security.
"This is not an extra," Buttigieg said. "This is not a luxury. This is not an option."
Biden’s $2.2 trillion infrastructure plan is light on cyber, but Psaki said the administration plans to talk to lawmakers about tying cybersecurity efforts to grants, as well as using tax credits to finance cybersecurity improvements.
She noted Colonial was an example that a cyberattack might not just affect a company but can imperil, "depending on the entity, the American public."
Efforts to get gas into the tanks of cars and airplanes, meanwhile, could highlight another issue — a shortage of tanker truck drivers.
"We’re definitely short on drivers," National Tank Truck Carriers interim President Ryan Streblow said on an industry call with reporters yesterday. He said that after furloughs and retirements during the pandemic, there are 10% fewer petroleum truck drivers than there were in 2019, even as people are driving more and using more gasoline.
The Biden administration has relaxed hours-of-service restrictions for drivers in many Southern states during the supply crunch. But groups such as the Energy Marketers of America are pushing for loosening the rules nationally to help with the driver shortage.
