The US must “rethink our approach to cybersecurity”, the acting chief of the agency charged with protecting federal networks told senators on Tuesday, as fallout from the Colonial pipeline ransomware attack saw panic-buying begin at some gas stations while the energy industry moved to shore up systems of supply.
“As the pace and scale of cyber threats we face expands so must our response tool kit,” Brandon Wales, acting director of the Cybersecurity and Information Security Agency (Cisa), said in Senate testimony.
“We need sustained investment to modernize and protect our most critical federal systems, as well as state and local governments, suffering under budget restraints and facing increasingly aggressive ransomware operators.”
The Colonial pipeline network moves fuels including gasoline, diesel and jet fuel from the Gulf coast east. The ransomware attack against it was made public last week. On Friday, Colonial shut its 5,500-mile network in order to protect its systems. It has restarted some smaller lines.
The FBI said DarkSide, a collective of cybercriminals, was responsible for the attack. A statement purporting to be from DarkSide said it aimed for financial rather than geopolitical gain.
Wales said: “Threats and technology are advancing substantially. It’s not surprising that a criminal enterprise like this is going after increasingly important targets. We’ve seen this over the past two years.”
DarkSide appears to have links to countries from the former Soviet Union. At the White House on Monday, Joe Biden said he would ask the Russian president, Vladimir Putin, to take action.
“We have efforts under way with the FBI and DoJ to disrupt and prosecute ransomware criminals,” the US president added.
On Tuesday, Moscow denied any involvement in the pipeline attack.
“Russia has nothing to do with these hacker attacks, and had nothing to do with the previous hacker attacks,” Dmitry Peskov, a spokesman for Putin, told reporters. “We categorically do not accept any accusations against us.”
US environmental regulators issued an emergency fuel waiver, to help alleviate any gasoline shortages in mid-atlantic states.
Panic buying has caused gas stations from Virginia to Louisiana to begin to run dry. One Washington DC-area fuel distributor told Bloomberg shortages were imminent.
“It’s going to be catastrophic,” said John Patrick, chief operating officer of Liberty Petroleum in Chester, Maryland. “Governors should declare a state of emergency and ask people chasing tanker trucks to gas stations to stay home. School buses stay put.”
Average retail gasoline prices touched $3 a gallon, their highest since late 2014, exacerbating fears of broader inflationary pressures on the economy.
The Environmental Protection Agency said its rule waiver, which relaxes some standards usually applied to fuel, would run through 18 May for fuel sold in Washington DC, Maryland, Pennsylvania and Virginia.
On its website, the EPA says waivers “help ensure that an adequate supply of fuel is available, particularly for emergency vehicle needs”.
Seeking to combat gasoline shortages, North Carolina has suspended restrictions on shipments.
The attack has also forced Gulf coast refineries to scale back operations due to lack of storage space. Refiners had also booked at least five tankers to store gasoline, according to sources and shipping data.
The tankers, booked by Marathon Petroleum, Valero Energy, Phillips 66 and PBF Energy, can hold around 350,000 tonnes of fuel. Two were booked for up to a month and three were provisional bookings that could be cancelled, according to data and shipbroking sources.
Traders also booked several tankers to ship gasoline and diesel from Europe to the US east coast.
French oil major Total SE and commodities trading houses Vitol and Trafigura each booked 90,000-tonne tankers to ship diesel on the transatlantic route, data showed, a relatively rare route as Europe consumes more diesel than it produces.
Several Gulf coast refiners that rely on Colonial for shipments cut output. Total and Motiva Enterprises cut gasoline production at their refineries in Port Arthur, Texas, and Citgo Petroleum pared back at its plant in Lake Charles, Louisiana, sources said.
