Full report
Q&A | The Risk of Russian Cyberattacks on US Energy Infrastructure
Q&A by Richard Nephew • March 31, 2022
Energy Explained
Get the latest as our experts share their insights on global energy policy.
China’s Slowing Oil Demand Growth Is Likely to Persist and Could Impact Markets
China’s demand for oil, long an important driver of global oil demand growth, slowed dramatically during January–September 2024. Between 2000 and 2023, China accounted for 50 percent of...
Podcasts
Hear in-depth conversations with the world’s top energy and climate leaders from government, business, academia, and civil society.
Where Climate and Trade Policy Meet
In passing and signing the Inflation Reduction Act in 2022, Congress and the Biden administration infused hundreds of billions of dollars into the energy transition. It was the...
Events
Find out more about our upcoming and past events.
November 21, 2024
• 6:00 pm - 8:30 pm
est
Careers in Sustainable Startups
Gender disparities in entrepreneurship are stark. Only one in every three businesses is owned by a woman.
Event
• Pillsbury Winthrop Shaw Pittman
Q&A | The Risk of Russian Cyberattacks on US Energy Infrastructure
Q&A by Richard Nephew • March 31, 2022
Although threats of cyberattacks on US energy infrastructure existed prior to the invasion of Ukraine, the crisis has heightened concern that Russia could pursue such action to retaliate against the United States for its support of Ukraine. In this Q&A, CGEP’s Amy Myers Jaffe and Richard Nephew examine this prospect and how energy companies might respond.
Does the Ukraine crisis make a cyberattack against US energy systems more likely?
The US government has warned private industry that it has “evolving intelligence” that Russia is considering cyberattacks against the United States. Russia has already been active in targeting energy-related systems. In an indictment issued last week, the US Justice Department said Russian agents persistently targeted more than 3,300 people working in the energy industry between 2014 and 2017. The US Nuclear Regulatory Commission was among the organizations targeted. Toby Rice, Chief Executive Officer of the US natural gas producer EQT, has said that cyberattacks targeting his firm have “gone up significantly” since the invasion. As Russia becomes increasingly frustrated in the face of a military stalemate and tightening sanctions, it could attempt a disruptive attack.
Does the energy industry face specific threats? What risks might emerge from a serious cyberattack?
The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert last week detailing what infrastructure owners should do to prepare communications to mitigate against specific cyber threats that exist, many of which target energy.
Just weeks before Russia’s invasion of Ukraine, a US-based security firm identified an attempted intrusion by hackers into multiple major natural gas suppliers and exporters, including the major liquefied natural gas export players Cheniere Energy Inc. and Kinder Morgan. That the attempted hacks were discovered and eliminated before they caused any major operational problems points to the importance of proper systems monitoring. However, it is unclear whether these were the only significant attacks mounted or the only significant attacks detected. US energy infrastructure is certainly a high-value target for Moscow, made more important by the overall turmoil in the energy market and benefits Russia could accrue through further disruptions to it.
The ransomware attack on Colonial Pipeline in May 2021 highlights the risks to critical infrastructure. Hackers entered the company’s information technology systems using employee profiles and passwords circulating on the dark web long before the attack. Colonial’s virtual private network (VPN) system lacked multifactor authentication and the company did not have proper processes to close down defunct, non-active VPN accounts. In the absence of sufficient, continuous monitoring of Colonial’s digital systems, the hackers stayed inside the systems for over a week, allowing them to prepare a major operation.
The Colonial Pipeline hack underscored the inherent risks that must be mitigated in digitizing operations and how interconnectivity must be analyzed beyond the fence line of energy infrastructure operations. The interconnectedness of the pipeline’s operational sensors with customer custody transfers, shared remote metering, storage operations, and eventually customer billing operations created a risk that extended beyond Colonial’s data systems to those of its customers along with the entire US East Coast—meaning the duration of the event could have been longer and its scale wider. The company had failed to segment its systems to allow for easier identification, response, and recovery, increasing time to service restoration. It also lacked a way to bypass its digital system and conduct some operations manually.
Around the same time, cyber intrusions hit municipalities and other entities near the main US crude oil storage hub of Cushing, Oklahoma, potentially testing for entry points to critical infrastructure.
Further, whereas the Colonial Pipeline event led to a temporary loss of access to fuel supplies, a cyber intrusion into safety, electrical, or pressure monitoring systems could lead to a major infrastructure accident such as an explosion or toxic release. In this case, companies should focus on understanding the risks to software safety control systems. In 2017, analysis of a failed cyberattack on a Saudi petrochemical plant raised the possibility that the intended goal of the attack was to sabotage safety controllers that regulate voltage, heat, and pressure at the plant—potentially to trigger an explosion.[1] Such safety controllers are found in most critical energy infrastructure, including refineries, petrochemical plants, and nuclear power stations.
What could the energy industry be doing to minimize the impact of a serious cyberattack on energy systems in the United States?
In 2017, malware attacks on the software system of the Dutch shipping company A.P. Moller-Maersk crippled its operations, which account for about one-fifth of all global cargo trade. However, a coincidental power cutoff in Lagos, Nigeria allowed the company to retrieve almost all of its online data backups from the hardware that was powered down in Nigeria. It took the firm nine days to restore the Active Directory that anchored its worldwide computerized operations. The malware attack also damaged Maersk’s 50,000 laptops and disabled its network of VoIP phones, resulting in operational disruptions and substantial replacement costs.
The event improved the understanding of best practice cyber hygiene and underscored the importance of investing in it financially. It also spurred many energy companies to establish real-time backup of data where the data is disconnected from the internet and thereby remains inaccessible to hackers. Because hackers cannot reach the backup data and therefore it cannot be compromised, this backup data is readily available for the recovery processes in the event of a cyberattack and ransomware does not need to be paid. Offline backups are now viewed as critical for all networks. It also highlighted the importance of response and recovery planning to cyber defense. Plans should include a chain of command for coordination leadership, external technical assistance, government reporting, and testing and restoration of systems using backup data. Denied access to data in its computer system, Maersk had to utilize on the ground staff to check containers manually for time sensitive cargo like medical supplies. This highlights the point that companies need to have an operational plan for manual solutions that can bypass damaged software systems and computers.
How has the US federal government reacted to the energy cyberattack threat?
Although more could be done to propel federal, state, and local authorities to improve preparedness for contingencies, the US Congress recently passed a cybersecurity law[2] requiring critical infrastructure entities to report material incidents within 72 hours and ransomware payments within 24 hours to CISA. The law also gave CISA subpoena power to use against entities that fail to report properly and the mandate to create an early warning program focused on new and emerging vulnerabilities. The Department of Homeland Security Transportation Security Administration has also imposed reporting requirements for designated pipelines and transportation operators. These measures are additional to the “Shields Up”[3] initiative that CISA already has in place, which provides information on cyber security and makes recommendations to firms.
Do US capabilities for a counter cyberattack constitute a deterrent effect?
It is unclear. In March, a Kremlin spokesman characterized economic sanctions against Russia as a US-orchestrated “economic war” on the country and warned that Russia would do “what is necessary” to defend its interests. To the extent that Western sanctions are effective in harming Russia’s banking or energy sector, the question of what Moscow would consider a proportional response becomes increasingly pertinent.
The United States also has capabilities to launch a retaliatory cyberattack of its own on Russian infrastructure, which Moscow will have to take into account. Russia and the United States have each penetrated the other’s energy grids, and Russia famously shut off[4] parts of the Ukrainian grid in the past. Moreover, the United States could interpret a highly disruptive attack as an act of war and respond with proportionate severity.
Notes
[1] Nicole Perlroth and Clifford Krauss, “A Cyber Attack in Saudi Arabia Had a Deadly Goal. Experts Fear Another Try,” The New York Times, March 15, 2018, https://www.nytimes.com/2018/03/15/technology/saudi-arabia-hacks-cyberattacks.html.
[2] Cyber Incident Reporting For Critical Infrastructure Act of 2022
[3] “Shields Up,” US Cybersecurity and Infrastructure Security Agency, accessed March 30, 2022, https://www.cisa.gov/shields-up.
[4] David E. Sanger and Nicole Perlroth, “US Escalates Online Attacks on Russia’s Power Grid,” The New York Times, June 15, 2019, https://www.nytimes.com/2019/06/15/us/politics/trump-cyber-russia-grid.html.
Relevant
Publications
China’s Slowing Oil Demand Growth Is Likely to Persist and Could Impact Markets
China’s demand for oil, long an important driver of global oil demand growth, slowed dramatically during January–September 2024. Between 2000 and 2023, China accounted for 50 percent of...
Falling Interest Rates Alone May Not Imminently Boost Investments in Renewable Energy
The US Federal Reserve (Fed) commenced its monetary easing cycle on Wednesday with an aggressive 50 basis points policy rate cut. The United States is not alone in...
The Case for Strengthening Sanctions Regimes to Fight Corruption
As new industries are emerging to support the energy transition, anti-corruption sanctions are an important part of the international effort to ensure that the global economy operates on...
