It should be making officials in the White House tremble. Critical infrastructure supplying 45% of the East Coast’s
diesel, gasoline and jet fuel, left at the mercy of a ransomware operation executed on May 6. In the process, 100 GB of
data of Colonial Pipeline was seized and encrypted on computers and servers. The next day, those behind the operation
demanded a ransom, or the material would be leaked.
The consequences are telling. The operator, taken offline to enable an investigation to be conducted by US cybersecurity
firm Mandiant; fuel left stranded at refineries in Texas; a spike in fuel prices at the pump – up six cents per gallon on the week to $2.967 per gallon of unleaded gasoline. “Unless
they sort it out by Tuesday,” warned oil market analyst Gaurav Sharma, “they’re in big trouble.” The impact would be felt first in Atlanta, then Tennessee,
perpetuating a domino effect to New York. “This is the largest impact on the energy system in the United States we’ve
seen from a cyberattack, full stop,” opined Rob Lee of the cybersecurity firm Dragos.
The company, in unconvincing tones, issued a statement that it was “continuing to work with third-party cybersecurity experts, law enforcement, and other federal agencies to
restore pipeline operations quickly and safely.” President Joe Biden rushed to calm fears that this had compromised fuel
security. “The agencies across the government have acted quickly to mitigate any impact on our fuel supply.” The deputy
national security advisor for cyber and emerging technologies Anne Neuberger waffled to the press that the Biden administration was “taking a multi-pronged and whole-of-government response to this incident and to
ransomware overall.”
On May 9, the Federal Motor Carrier Safety Administration within the Department of Transportation issued a temporary hours of service exemption for motor carriers and drivers “transporting gasoline, diesel, jet fuel and
other refined petroleum products” across affected States.
Finding the culprit in such operations is almost boringly predictable. The Kremlin tends to get top billing on the list
of accused, but on this occasion interest centred on DarkSide rather than President Vladimir Putin. “I’m gonna be
meeting with President Putin,” promised Biden, “and so far there is no evidence, based on our intelligence people, that Russia is involved.” That did not mean
that Russian officials were to be spared scrutiny. There was “evidence that the actors’ ransomware is in Russia – they
have some responsibility to deal with this.” DarkSide, in other words, is being singled out as a bold and enterprising
Russian cybercrime outfit, going where even intelligence operatives fear to tread. Out in that jungle of compromised
cybersecurity, money is to be made.
DarkSide is cybercrime with a professional face, pirates and buccaneers of the internet with some understanding of
public relations. They court the press when they need to. They even operate with a code of conduct in mind. And they are
experienced. “Our goal is to make money and not creating problems for society,” lamented the group after the operation. “We do not participate in geopolitics, do not see need to tie us with a defined
government and look for… our motives.” The firm claimed ignorance that one of its affiliates had taken it upon
themselves to target Colonial. “From today, we introduce moderation and check each company that our partners want to
encrypt to avoid social consequences in the future.”
This event has revealingly exposed the state of poorly protected critical infrastructure run by private companies. “When
those companies are attacked,” remarked deputy national security advisor Elizabeth Sherwood-Randall, “they serve as the first line of defence, and we depend on
the effectiveness of their defences.”
As security analyst Richard Stiennon described it, the decision to shut down the pipeline showed that Colonial understood the risks. “On the other hand, it shows that
Colonial does not have 100% confidence in their operational systems’ cybersecurity defenses.” Colonial was doing its
best to sound competent, stating that it “proactively took certain systems offline to contain the threat.”
A less generous reading of this is that the company never genuinely appreciated those risks, given inadequate backup
systems or forking out funds for software with fewer vulnerabilities. The company had effectively issued an open
invitation to be targeted, despite warnings made in early 2020 by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency that a
ransomware attack on a US-based natural gas compression facility had taken place.
The provider has done little in terms of clearing the air on how it will deal with the ransom threat. “Colonial is a
private company and we’ll defer information regarding their decision on paying a ransom to them,” stated the less than helpful Neuberger. Neuberger also spoke of the “troubling trend … of targeting companies who have insurance and may be richer targets”. More had to be done to
“determine what we do in addition to actively disrupting infrastructure and holding perpetrators accountable, to ensure
we are not encouraging the rise of ransomware.”
The Biden administration is currently drafting an executive order that will create new digital safety regulations applicable to federal agencies and contractors who develop software for
the government. Those developing the software would have to be compliant with adequate security safeguards. A layer of
investigative bureaucracy is also contemplated: a cybersecurity incident review board.
At the very least, optimists in the field will see some value in having glaring faults in security systems exposed, even
if it pertains to critical infrastructure. Cyber extortionists can be turned into constructive citizens, identifying
vulnerabilities – for a price. A better option for corporate management and the boardroom would be to listen to the IT
crowd.
Dr. Binoy Kampmark was a Commonwealth Scholar at Selwyn College, Cambridge. He lectures at RMIT University, Melbourne.
Email: bkampmark@gmail.com