Held to ransom: Colonial pipeline and the vulnerabilities of critical infrastructure

It should be making officials in the White House tremble. Critical infrastructure supplying 45% of the East Coast's diesel, gasoline and jet fuel, left at the mercy of a ransomware operation executed on May 6. In the process, 100 GB of data of Colonial Pipeline was seized and encrypted on computers and servers. The next day, those behind the operation demanded a ransom, or the material would be leaked.

The consequences are telling. The operator, taken offline to enable an investigation to be conducted by US cybersecurity firm Mandiant; fuel left stranded at refineries in Texas; a spike in fuel prices at the pump – up six cents per gallon on the week to $2.967 per gallon of unleaded gasoline. "Unless they sort it out by Tuesday," warned oil market analyst Gaurav Sharma, "they're in big trouble." The impact would be felt first in Atlanta, then Tennessee, perpetuating a domino effect to New York. "This is the largest impact on the energy system in the United States we've seen from a cyberattack, full stop," opined Rob Lee of the cybersecurity firm Dragos.

The company, in unconvincing tones, issued a statement that it was "continuing to work with third-party cybersecurity experts, law enforcement, and other federal agencies to restore pipeline operations quickly and safely." President Joe Biden rushed to calm fears that this had compromised fuel security. "The agencies across the government have acted quickly to mitigate any impact on our fuel supply." The deputy national security advisor for cyber and emerging technologies Anne Neuberger waffled to the press that the Biden administration was "taking a multi-pronged and whole-of-government response to this incident and to ransomware overall."

On May 9, the Federal Motor Carrier Safety Administration within the Department of Transportation issued a temporary hours of service exemption for motor carriers and drivers "transporting gasoline, diesel, jet fuel and other refined petroleum products" across affected States.

Finding the culprit in such operations is almost boringly predictable. The Kremlin tends to get top billing on the list of accused, but on this occasion interest centred on DarkSide rather than President Vladimir Putin. "I'm gonna be meeting with President Putin," promised Biden, "and so far there is no evidence, based on our intelligence people, that Russia is involved." That did not mean that Russian officials were to be spared scrutiny. There was "evidence that the actors' ransomware is in Russia – they have some responsibility to deal with this." DarkSide, in other words, is being singled out as a bold and enterprising Russian cybercrime outfit, going where even intelligence operatives fear to tread. Out in that jungle of compromised cybersecurity, money is to be made.

DarkSide is cybercrime with a professional face, pirates and buccaneers of the internet with some understanding of public relations. They court the press when they need to. They even operate with a code of conduct in mind. And they are experienced. "Our goal is to make money and not creating problems for society," lamented the group after the operation. "We do not participate in geopolitics, do not see need to tie us with a defined government and look for… our motives." The firm claimed ignorance that one of its affiliates had taken it upon themselves to target Colonial. "From today, we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future."

This event has revealingly exposed the state of poorly protected critical infrastructure run by private companies. "When those companies are attacked," remarked deputy national security advisor Elizabeth Sherwood-Randall, "they serve as the first line of defence, and we depend on the effectiveness of their defences."

As security analyst Richard Stiennon described it, the decision to shut down the pipeline showed that Colonial understood the risks. "On the other hand, it shows that Colonial does not have 100% confidence in their operational systems' cybersecurity defenses." Colonial was doing its best to sound competent, stating that it "proactively took certain systems offline to contain the threat."

A less generous reading of this is that the company never genuinely appreciated those risks, given inadequate backup systems or forking out funds for software with fewer vulnerabilities. The company had effectively issued an open invitation to be targeted, despite warnings made in early 2020 by the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency that a ransomware attack on a US-based natural gas compression facility had taken place.

The provider has done little in terms of clearing the air on how it will deal with the ransom threat. "Colonial is a private company and we'll defer information regarding their decision on paying a ransom to them," stated the less than helpful Neuberger. Neuberger also spoke of the "troubling trend … of targeting companies who have insurance and may be richer targets". More had to be done to "determine what we do in addition to actively disrupting infrastructure and holding perpetrators accountable, to ensure we are not encouraging the rise of ransomware."

The Biden administration is currently drafting an executive order that will create new digital safety regulations applicable to federal agencies and contractors who develop software for the government. Those developing the software would have to be compliant with adequate security safeguards. A layer of investigative bureaucracy is also contemplated: a cybersecurity incident review board.

At the very least, optimists in the field will see some value in having glaring faults in security systems exposed, even if it pertains to critical infrastructure. Cyber extortionists can be turned into constructive citizens, identifying vulnerabilities – for a price. A better option for corporate management and the boardroom would be to listen to the IT crowd.