There are currently some 2.7 million miles of pipeline transporting hazardous substances across the United States. These pipelines often run through multiple states and expose both remote areas and highly populated urban areas to accidents, operating mistakes, and intentional harm caused by hostile actors. Threats falling in the last category have traditionally been limited to physical attacks on pipeline integrity in attempts to cause harmful breaches. However, the high technology age has given rise to a new spectrum of technologically driven threats that can be initiated through purely electronic means. Safeguarding the nation’s pipeline infrastructure against these threats is an ongoing task requiring methodical and meticulous analysis.

In addition to being a vital part of the US economic system, the energy sector is a popular target for hostile factions seeking to harm the United States and her interests. Between 2013 and 2015, attacks on the Energy Sector accounted for 35% of a total 796 reported critical infrastructure cyber incidents. The task of providing oversight of the various government agencies, pipeline operators, and third-party security elements that constitute the nation’s pipeline security system falls to the Department of Homeland Security’s (“DHS”) Transportation Security Administration (“TSA”). The TSA administrates oversight through its Pipeline Security Program (“PSP”), the nation’s effort to monitor the overall status of pipeline security.

Operators of interstate pipelines transporting hazardous substances such as oil and natural gas must follow TSA guidelines to prepare against physical and cyber threats. Troublingly, a 92-page report published on December 18, 2018 by the US Government Accountability Office (“GAO”) has highlighted a number of weaknesses in the TSA’s current security scheme. The report also provided a number of recommended improvements that, if implemented, could enhance the program’s effectiveness. The report was inspired by the data-driven realization that pipelines increasingly utilize networked computer systems in their operation. These computer systems, like most others, are vulnerable to cyberattack, providing potential pipeline saboteurs an additional avenue of attack.

One area of weakness the report identified in the current guidelines is ambiguity in the definitions used to describe critical pipeline facilities. A pipeline system is often made up of multiple component parts. In addition to the pipeline itself, a system may include pump stations, refineries, and storage facilities. In theory, critical facilities, facilities essential the operation of the system, should be identified and reported for further risk analysis. The GAO report found that under the current guidelines, 34 of America’s top 100 critical pipeline systems deemed as “highest risk” have not identified any critical facilities. The report attributes this shortcoming in reporting outcomes to the guidelines’ inability to precisely define critical facilities. Therefore, the current analysis of risk and vulnerability of critical facilities is incomplete.

The GAO report also found that the TSA, which conducts pipeline security reviews, has not conducted these reviews in a methodical or consistent manner since 2010. Rather, the reporting frequency of the TSA fluctuates wildly from 2010 to present day. The GAO report generally attributes the TSA’s failure to consistently administrate security reports to shortcomings in staff. Between 2010 and 2018, the number of staff members in the TSA’s pipeline security branch has fluctuated between 1 and 14 members. The report also discussed a failure to update risk assessment methodology since the metrics were first established in 2014. As a result, the metrics are out of date and fail to reflect current threats to pipeline operators.

Understandably, the last few points may read as a lot of ruckus over what sounds intangible. How does the secure operation of pipelines link with academic distinctions in reporting systems? The significance of these shortcomings becomes easier to place if we remember to think of the threat to pipeline security as being digital, as well as physical. Even a few years ago, before computers were so heavily integrated into pipeline systems, attacks on America’s energy supply by hostile factions had to be physical. Security was therefore a matter of preventing criminals from cutting open pipes with blowtorches or from shutting down a pump station by cutting the powerline. Now, attacks can be launched against pipeline computers from remote locations at any time. For example, a hostile foreign power could hack into a US pipeline terminal and disrupt energy delivery from thousands of miles away.

Thus, dealing with these threats is more complicated than setting up barbed-wire fencing and conducting regular car patrols. Successfully stopping attacks on pipelines in the digital age requires the implementation of a robust security system, built from reliable data, and maintained with meticulous and regular updates. That’s why definitions and reporting frequency are crucial. As the GAO points out, the governmental agencies in charge of this security have plenty of work ahead of them to make these systems fully effective in the age of cyber-attacks.

For landowners whose property is already burdened with a pipeline, or for landowners facing the prospect of a pipeline being installed on their land, the GAO report highlights the very real evolution in the threats that pipelines are vulnerable to. The digital revolution, with all it’s marvelous advances, has provided terrorists, environmental extremists, and hostile foreign powers a new channel through which they can sow chaos and destruction by attacking America’s energy systems. Landowners forced to bear this additional risk should ensure they are adequately compensated for their burdens.

 

Written by Christopher Chan