On May 7, 2021, Colonial Pipeline, which delivers about 45 percent of petroleum products consumed on the East Coast, was cyberattacked. The pipeline transports gasoline, diesel, jet fuel, and home heating oil from refineries located on the Gulf Coast through pipelines running from Texas to New Jersey. Its pipeline system, the largest petroleum pipeline on the East Coast, spans more than 5,500 miles, transporting more than 100 million gallons a day over two lines: one for gasoline and one for diesel, jet fuel, etc.
The cyberattack affected some of the pipeline’s information technology systems and as a result, certain systems had to be taken offline, halting pipeline operations. The attack underscores the vulnerabilities of critical infrastructure to cyberattacks that threaten to impede operations. In the past decade, systems that directly manage a pipeline’s operation have been increasingly connected to computer networks.
According to the FBI, the breach of the Colonial Pipeline system was done by a gang of criminal hackers named DarkSide, whose members are Russian speakers. The syndicate’s malware is coded not to attack networks using Russian-language keyboards. This event concerning our energy pipeline delivery system has the potential for significant energy and economic disruptions, while also demonstrating the importance of American pipelines to our energy security.
According to an oil analyst, the impact of the attack on fuel supplies and prices depends on how long the pipeline is down. An outage of one or two days would be minimal, but an outage of five or six days could cause shortages and price hikes, particularly in an area stretching from central Alabama to the Washington, D.C., region. Parts of South Carolina have reported gasoline stations without gasoline as early as Monday, May 10. Some of the biggest impacts in the Carolinas are expected to be felt inland because gasoline can still come into the coast through the ports. “Tank farms,” which are massive storage areas the Colonial Pipeline feeds into, are drying up due to the outage.
A lengthy delay would impact the supply of jet fuel needed to keep major airports operating. Several airports that depend on the pipeline for jet fuel, including Nashville, Tennessee; Baltimore-Washington; and Charlotte and Raleigh-Durham, N.C., could have a hard time later this week receiving jet fuel shipments. Airports generally store enough jet fuel for three to five days of operations.
Colonial engaged a third-party cybersecurity firm to investigate the “nature and scope of this incident” and also contacted law enforcement and other federal agencies. FireEye Mandiant has been hired to manage the investigation. Also, the U.S. Cybersecurity and Infrastructure Security Agency is engaged with the company and its interagency partners regarding the situation.
According to the pipeline operator, it is developing “a system restart plan” and would restore service to some small lines between terminals and delivery points but “will bring our full system back online only when we believe it is safe to do so.” However, it hopes to have services mostly restored by Friday, which means that gas stations should start to fuel up early next week as long as people are moderate in their usage. The problem count last two to three weeks in some areas if usage is high. To ease the impact, the Transportation Department on Sunday lifted some restrictions on the transport of gasoline, diesel and jet fuel by road to address what it called “emergency conditions.”
Cyberattacks and Their Frequency
The cyberattacks involve a type of malicious software that locks up a victim’s computer and renders it unusable until the victim pays off the attacker, frequently in Bitcoin. These attacks, mostly by criminal syndicates operating out of safe havens, escalated last year, costing hospitals, medical researchers private businesses, state and local governments and schools tens of billions of dollars. Average ransoms paid in the United States jumped nearly threefold to over $310,000 last year. The average downtime for victims of ransomware attacks is about 21 days.
Impact on Petroleum Prices
While there has been some price impact, prices have not risen much so far because the East Coast generally has ample supplies of fuel in storage and petroleum consumption, while growing, remains somewhat depressed from pre-COVID levels. Despite that, there still are vulnerabilities in the supply system. Stockpiles in the Southeast are slightly lower than normal for this time of year. Refinery capacity in the Northeast is increasingly limited, and the Northeast Gasoline Supply Reserve, a supply held for emergency interruptions, contains only a total of one million barrels of gasoline in New York, Boston and South Portland, Maine—less than a single day of average regional consumption.
But, other problems loom, especially in an extended outage. Two U.S. Gulf Coast oil refineries reduced fuel production on Monday as the Colonial Pipeline outage limited their ability to move products to market. The largest U.S. refinery, Motiva Enterprises, cut its production by 45 percent. The 607,000 barrel-per-day Port Arthur, Texas, plant shut two crude distillation units on Sunday as well as a reformer. Total SE reduced its gasoline output by about 25 percent at its 225,500-barrel-per-day oil refinery in Port Arthur by trimming its fluidic catalytic cracker output and shutting a condensate splitter. The largest U.S. independent refiner, Marathon Petroleum, is working to find alternatives for shipping from its Gulf Coast plants in event the pipeline shutdown is extended.
In 2017, Colonial Pipeline flows were affected by Hurricane Harvey when several refineries were closed on the Gulf Coast, suspending pipeline flows for nearly two weeks. That resulted in spot gasoline prices at New York Harbor to increase by over 25 percent and took nearly a month to subside.
Other Possible Alternatives
Kinder Morgan’s Plantation Pipeline, which operates between Louisiana and Northern Virginia, can supply regional refineries, but its capacity is limited and it does not reach major metropolitan areas north of Washington, D.C. The East Coast can import petroleum products from Europe, Canada and South America, but that can take time. For example, tankers sailing from the port of Rotterdam, the Netherlands, at speeds of up to 14 knots can take as long as two weeks to make the trip to New York Harbor.
The Biden administration could suspend the Jones Act, which requires that goods shipped between American ports be transported on American-built and -operated vessels. That would allow foreign-flagged tankers to move additional barrels of fuel from Gulf ports to Atlantic Coast harbors. The Jones Act is typically suspended during emergencies like hurricanes.
Conclusion
A major U.S. petroleum pipeline was cyberattacked on Friday, May 7. The operator hopes to have it back on line by Friday, May 14. The Colonial Pipeline is the largest pipeline serving the East Coast and supplies the region with gasoline, jet fuel, diesel and heating oil. Prices for these fuels could increase on the East Coast if the pipeline is unable to come back on-line quickly. Jet fuel supplies are expected to be affected the most since airports do not keep very many days of supply. While some alternatives exist, they are either not quick solutions as with importing petroleum products or they are limited in scope as are truck deliveries or increasing flow on other pipelines that do not reach the entire affected area. Despite the protestations of some who oppose pipelines, they efficiently and safely make life possible for hundreds of millions of Americans and are a vital component in our economic and national security.
