US to Set New Pipeline Rules to Protect Against Cyberattacks

US to Set New Pipeline Rules to Protect Against Cyberattacks

The United States plans to launch new rules designed to protect pipeline companies against increasing cyberattacks.

The action follows a cyberattack earlier this month that shut down a major U.S. fuel pipeline. The outage, involving a 9,000 kilometer pipeline system, led to temporary fuel shortages in some places in the eastern United States.

U.S. officials say new cybersecurity regulations are expected to be issued this week by the Transportation Security Administration (TSA). The TSA oversees the nation’s network of pipelines.

The Department of Homeland Security (DHS) said Tuesday that TSA officials had already begun working with private pipeline companies on ways to identify and prevent cyberattacks.

A person fills their car with gas as people queue at a Shell gas station, after a cyberattack crippled the biggest fuel pipeline in the country, run by Colonial Pipeline, in Washington, D.C., U.S., May 15, 2021. REUTERS/Andrew Kelly

One of the new regulations will require the companies to report cyber threats to the federal government, one official told The Associated Press. Another rule is expected to require pipeline operators to complete a self-examination of their systems for possible vulnerabilities to cyberattacks.

Mark Montgomery is with the Foundation for the Defense of Democracies. He is also the former director of the congressionally supported Cyberspace Solarium Commission.

Montgomery told the AP he sees the expected requirements as “a good step” forward in the fight against cyberattacks. He added that such regulations need to be put in place for non-pipeline companies as well, “so that all our national critical infrastructure is at a higher level.”

At a news conference this week, DHS Secretary Alejandro Mayorkas spoke about the ransomware attack that shut down the Colonial Pipeline. He said that kind of attack “is one of the greatest cybersecurity threats that we face in the United States.”

Secretary of Homeland Security Alejandro Mayorkas speaks about aviation security ahead of the summer travel season during a news conference at Ronald Reagan Washington National Airport, Tuesday, May 25, 2021, in Arlington, Va. (AP Photo/Patrick Semansky)

In a ransomware attack, online attackers infect the computer systems of organizations and hijack data in a way that leaves it unreadable. The attacker then demands payment in exchange for returning the data to a usable state.

Colonial Pipeline in Georgia said it had paid a ransom of $4.4 million to regain control of its data from the cybercriminals. The Federal Bureau of Investigation has linked the attack to a Russian-speaking criminal group known as DarkSide.

Suzanne Spaulding is a cybersecurity expert with the Center for Strategic and International Studies based in Washington, D.C. She said many companies are still not taking steps to protect themselves.

"There are two kinds of companies in the world, those who have been hacked and those who haven't detected it yet," she told the French press agency AFP.

Gas pumps are covered with plastic bags at the Race Trac gas station, after a cyberattack crippled the biggest fuel pipeline in the country, run by Colonial Pipeline, in St. Petersburg, Florida, U.S., May 12, 2021. REUTERS/Octavio Jones

Spaulding noted one problem is that many countries cannot produce enough computer workers who are trained to deal with serious cyber threats. This shortage drives up pay rates, making it difficult for many organizations to employ quality workers with the right skills.

Private cybersecurity companies have been helpful to organizations facing threats and can also help prevent new attacks. But a new report suggests that publicizing anti-ransomware measures can also help cybercriminals.

The report was published jointly by MIT Technology Review and ProPublica. It details how Romanian cybersecurity company BitDefender announced in January it had found a fix to help companies avoid ransomware attacks by the DarkSide group.

BitDefender said it had discovered a flaw in the ransomware that DarkSide had been using to freeze computer networks of American and European businesses.

This photo illustration shows a screen displaying the Darkside onionsite address with a notice saying it could not be found, in Arlington, Virginia on May 14, 2021. (AFP)

But by bringing attention to its fix, BitDefender also let DarkSide know about the flaw, which it was able to quickly repair. The next day, DarkSide declared: “Special thanks to BitDefender for helping fix our issues. This will make us even better.”

The fix was quickly confirmed when DarkSide carried out a series of new attacks, including the hijack of Colonial Pipeline’s data.

The joint report notes that two other cybersecurity experts had also discovered BitDefender’s flaw a month before BitDefender. But those researchers did not publicly announce their finding. Instead, they began secretly reaching out to possible victims to offer help.

I’m Bryan Lynn.

Bryan Lynn wrote this story for VOA Learning English, based on reports from Reuters, The Associated Press, Agence France-Press, MIT Technology Review and ProPublica. Mario Ritter, Jr. was the editor.

We want to hear from you. Write to us in the Comments section, and visit our Facebook page.

_____________________________________________________________

Words in This Story

regulation – n. an official rule that controls how something is done

vulnerable – adj. able to be easily hurt, influenced or attacked

infrastructure – n. the basic equipment and structures (such as roads and bridges) that are needed for a country or region

hack – n. to use a computer to illegally get into someone else’s computer system to read the information that is kept there

detect – v. to discover or notice something

flaw – n. a mistake or defect