SC and NC were in the path of the pipeline hack. Here’s what could be done in the future
The hack that shuttered a sprawling oil and gas pipeline system from Texas to New Jersey exposed major flaws in North and South Carolina’s energy infrastructure and regulation, experts say.
Colonial Pipeline shut down May 7 after Eastern European criminals took hold of its business information systems. After round-the-clock efforts, the company slowly began restarting operations on May 12. It could take another two weeks before the pipeline is fully operational.
The pipeline serves nearly 70% of the oil and gas for the Carolinas. If the shut down had continued for more than a week, energy experts estimated that the impact on the local economies of the two states could have been devastating. Panic buying began to cause problems in both states within days of the pipeline closure.
At the height of their shortages, at least 71% of stations in North Carolina and 54% in South Carolina were out of gasoline, quickly affecting small-scale transportation needs. Newspaper deliveries were interrupted, one Sun News staff member reported that Lowe’s Home Improvement couldn’t deliver a new appliance and government officials in both states begged people to avoid nonessential travel and not hoard gasoline.
Five experts in the fields of cybersecurity, civil engineering, energy economics and the psychology of panic buying spoke with a reporter about why the Carolinas’ oil and gas infrastructure and federal regulatory policy are particularly vulnerable to major shutdowns and what can be done in the future to mitigate their effects.
What happened
When Colonial Pipeline shut down it’s 5,500 mile system, it was a precautionary measure. The computers that control the pipeline’s operations itself had not been affected, the company said.
Doing that meant no new fuel was coming out of one of America’s largest oil and gas transporters for five full days. Experts said that because of the nation’s reliance on “just-in-time delivery” — getting goods to their destination right when they are needed and having few, if any, back up supplies — meant the Southeast could quickly run low on fuel.
Some fuel began flowing May 10, but the Colonial Pipeline didn’t begin its full restart of operations until May 12. Charlotte-based Wells Fargo economist Mark Vitner said a true gasoline shortage would not have begun unless the pipeline shuttered for at least a week or more.
Had the pipeline shut down gone on much longer, the Carolinas would have run dangerously low on gasoline and eventually other kinds of oil and gas like diesel and jet fuel. In preparation for such an eventuality, American Airlines added a stop to a normally-direct flight between Charlotte and Honolulu, Hawaii to conserve fuel.
Yuche Chen, a civil engineering professor at the University of South Carolina, said it could be before Memorial Day before the Carolinas see a full recovery from the pipeline shut down because the two states are so far up the pipeline.
“The pipeline is like a highway,” Chen said. “If there is an accident on a highway, once the blockage is removed, it’s not really instant relief. It takes time to get those vehicles to go through.
“It’s really very complicated and a very huge system,” he said. “It really takes time for them to slowly move all the gas” through the pipeline.
Before the Carolinas reached a critical point for flying, though, tourism would have seen a steep decline in both states, experts said. They are heavily served by “drive-markets,” visitors who come from both near and far by car rather than flying. There were some limited effects on local economies, ride-hailing services like Uber and Lyft as well as delivery services struggled to weather the run on gasoline, Vitner said.
Profit vs. protecting critical infrastructure
The Carolinas don’t have much in the way of oil and gas refineries, experts said. The growth of major pipeline systems has made it cheaper to coalesce these industries in one or two places, like Houston, where the Colonial Pipeline starts.
Just a few companies operate these pipeline systems, and it’s rare to have more than one Colonial Pipeline-size system serving a single region. Pipelines are expensive to build, Vitner said, so it hasn’t made financial sense to have secondary pipelines — “redundancies” — in the event of catastrophes like the Colonial hack.
Nevertheless, “if you think this is going to happen on a regular basis, then you prepare for it,” said Bob Cox, a cybersecurity policy expert at USC. “It seems in this case, it wasn’t something that was anticipated to be a problem. Now we know it can be a problem. Then the question is, how do you prepare for it?”
A cheaper option, Cox said, is that companies could expand “tank farms,” where fuel goes before being trucked to gas stations, or build more of them.
Chen, the civil engineering professor, said what happened to Colonial Pipeline is just one of many examples of the problems with America’s aging infrastructure. The nation received a C- rating in the most recent infrastructure report card by the American Society of Civil Engineers.
Concerns about failing bridges and dams are more obvious examples of the nation’s infrastructure problems, but now the nation must contend with beefing up its online firewalls as well.
Hacking is still a relatively new issue for businesses and governments. But it is becoming more common every day, said Chin-Tser Huang, a USC computer science professor who specializes in cybersecurity.
One of the most common forms of hacking is ransomware, cybersecurity experts say, where hackers lock computer systems and demand money in exchange for an electronic “key” to be able to access those systems again.
Regulation in that area is sparse, experts said.
“The banking system, for example, has to go through stress tests” to ensure it doesn’t collapse in the onset of adverse events, Vitner said. “We may see that the companies that are involved in critical infrastructure in the US may have to pass certain stress tests,” such as having backup computers that can be switched to if a company is hacked.
As our lives become more online, there are increasingly expanded ways for hackers to get in, Cox said.
“One of the big lessons is to isolate the business computers from the pipeline management, which is actually a tricky challenge to do,” Cox said. “But there are people doing work on how to create servers that are firewalled sufficiently while still allowing business operations to move effectively.”
Maintaining cybersecurity infrastructure can be extremely expensive. The lack of regulation from government bodies also leaves the companies that run some of the most important parts of the nation’s infrastructure to their own devices when deciding whether the cost of cybersecurity is worth the risk.
In some cases, all hackers might need to take down an entire business is one computer that hasn’t been updated recently. Cox compares what happened with Colonial Pipeline to the SolarWinds hack, which compromised government agencies, including the Treasury and Commerce departments, via a virus hiding inside a software update.
“There might be best practices for maintaining security of your business operations, but that’s always going to come at a cost,” Cox said. “That’s a very difficult area for the government to regulate — to say that you have to maintain your payroll software up to date, for example, as a function of doing business because you’re a pipeline operator.”
Infrastructure companies are much more experienced in handling natural disasters, like hurricanes, but their effects tend to be isolated to much smaller areas than what we saw with the Colonial Pipeline shutdown, experts said.
The February winter storm that shuttered oil and gas plants across Texas was one of the country’s biggest tests yet when it comes to how isolated energy production has become. Those plants make up 31% of the nation’s refining capacity. Fears of gasoline shortages spread across the U.S.
Refineries got back online quickly enough to prevent a shortage from happening, and tank farms had enough supply to keep the Southeast running, experts said.
The Colonial Pipeline restarted even faster than many of those Texas refineries. So why did the Carolinas start running out of gasoline?
Panic buying.
“We don’t have any surge capacity to get gasoline from the tank farms to the gasoline stations,” said Vitner, the Wells Fargo economist. “I can’t imagine that these tank farms are running dry. I don’t think that happened. There wasn’t enough time for that.”
How to stop panic-buying, if at all
Hoarding gasoline, a highly flammable substance, is extremely dangerous. One South Carolina woman experienced this personally when tanks of gasoline in her trunk exploded during a police chase, causing her to catch on fire.
The woman was one of many panic buyers around the Carolinas who raced to gas stations last week for fear of running out of gasoline. Yet, if it weren’t for panic buying, neither state would have seen a run on gasoline. The states never ran out of diesel or jet fuel, which comes from the Colonial Pipeline system just like gasoline.
Fuel was still flowing to gas stations. Everyday drivers just kept bleeding them dry faster than trucks could deliver. The U.S. also has a nationwide shortage of truck drivers, making it harder to get fuel from tank farms to gas stations.
Some stations around the Carolinas put in $25-$50 caps on fuel purchases. They wanted to stave off running out completely and ensure people who really needed it could at least get some gas.
Rationing like this is common during hurricanes or other events that might create gasoline shortages, and the infrastructure for quickly implementing purchasing caps exists, experts said. The problem was that not enough gas stations were controlling fuel sales, leading to widespread outages of fuel supplies in high-traffic areas.
People engage in panic buying because of “anticipated regret,” they fear realizing down the line that they made the wrong decision, USC psychology professor Doug Weddell said.
“People in general are risk averse,” Weddell said. “They don’t want to get caught making the wrong decision ... You don’t want to be sitting there afterwards going, ‘If only I had bought extra gasoline I wouldn’t be stuck on the side of the road right now.’”
It’s hard to fight back against these fears, even for those who know better, and all it takes to create a surge of panic buyers is a few people breaking.
“You find herd mentality,” in crisis situations Weddell said. “If I see a whole bunch of people there at the gas station, I want to conform — ‘What do they know that I don’t know?’”
The best fix to stop panic buying would be a government mandate, said Vitner, the Wells Fargo economist. Relying on an entire group of people to self-regulate and think logically in a crisis is a recipe for disaster, Weddell said. It wouldn’t even take an act of the legislature to do it. Mandating a cap on fuel purchases, for example, falls under the existing emergency powers available to the governor of North Carolina. And in the past, the South Carolina governor’s office reduced speed limits around the state in the wake of a gas shortage to help conserve fuel.
“If you knew that you could only get 12 gallons of gas, you might make you think twice about whether or not you wanted to line up for it,” Vitner said.
Renewable energy
There’s one potential major fix already on the way, and the Carolinas’ state and local governments could directly help it along.
Renewable energy.
All five of the experts interviewed for this story agreed that the best way to handle a future cyberattack like this is to expand the options for energy usage in the region. Right now, the Carolinas — and the U.S. as a whole — still rely heavily on fossil fuels for energy consumption, particularly when it comes to cars.
The growth in renewable energy and electric cars could serve as a stopgap in the future in the case of oil and gas pipeline issues. No need to rush to the pump if the car doesn’t run on gas. And there’s already growing sentiment that the nation needs to invest in renewable energy to stop climate change.
“That’s another form of redundancy, just having alternative forms of energy, so that one source of energy is not your major challenge,” Cox said. “That’s not going to happen quickly, but the smart actors in that space are thinking long term about that.”
Power plants could be better served as well. If a hurricane or cyberattack knocks out a natural gas power plant, windmills or solar panels could still operate once the weather clears. As a whole, diversifying the region’s energy production could reduce reliance on individual sources, experts said. Losing one wouldn’t cripple the whole region.
Federal agencies and energy producers have had their eye on South Carolina’s Grand Strand for years as a place to build a massive wind farm. North Myrtle Beach has supported expanding wind energy in the region for more than a decade now. In 2010, the first wind turbine to be connected to the state’s power grid was built on the city’s Oceanfront Park.
North Carolina in 2018 ranked third in the nation for the growth of solar energy production. It also ranked 10th in the nation in electric vehicle charging stations. Yet, North Carolina’s legislature has often opposed offshore wind power by trying to impose temporary bans on building wind farms or adding more regulatory hurdles.
Lack of government support has been one of the biggest problems standing in the way of renewable energy’s growth, experts said.
The Biden administration wants to change that with its American Rescue Plan, which would provide billions for building solar farms and wind turbines. Both North and South Carolina could also take steps in that direction, experts said, by providing more tax breaks for companies who want to expand their green energy footprint, as has been done in Texas, one of the biggest green energy producers in the world, and California.
“A lot of the innovations we see developing in that space are due to state-level incentives, not due to federal incentives,” Cox said. “The smart states are trying to use it as a way to lure high-tech jobs, high-paying manufacturers, jobs and technology.”
This story was originally published May 19, 2021 at 5:00 AM with the headline "SC and NC were in the path of the pipeline hack. Here’s what could be done in the future."
