[Senate Hearing 117-768]
[From the U.S. Government Publishing Office]
S. Hrg. 117-768
PIPELINE CYBERSECURITY:
PROTECTING CRITICAL INFRASTRUCTURE
=======================================================================
HEARING
BEFORE THE
COMMITTEE ON COMMERCE,
SCIENCE, AND TRANSPORTATION
UNITED STATES SENATE
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
__________
JULY 27, 2021
__________
Printed for the use of the Committee on Commerce, Science, and
Transportation
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available online: http://www.govinfo.gov
__________
U.S. GOVERNMENT PUBLISHING OFFICE
54-109 PDF WASHINGTON : 2023
-----------------------------------------------------------------------------------
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
ONE HUNDRED SEVENTEENTH CONGRESS
FIRST SESSION
MARIA CANTWELL, Washington, Chair
AMY KLOBUCHAR, Minnesota ROGER WICKER, Mississippi, Ranking
RICHARD BLUMENTHAL, Connecticut JOHN THUNE, South Dakota
BRIAN SCHATZ, Hawaii ROY BLUNT, Missouri
EDWARD MARKEY, Massachusetts TED CRUZ, Texas
GARY PETERS, Michigan DEB FISCHER, Nebraska
TAMMY BALDWIN, Wisconsin JERRY MORAN, Kansas
TAMMY DUCKWORTH, Illinois DAN SULLIVAN, Alaska
JON TESTER, Montana MARSHA BLACKBURN, Tennessee
KYRSTEN SINEMA, Arizona TODD YOUNG, Indiana
JACKY ROSEN, Nevada MIKE LEE, Utah
BEN RAY LUJAN, New Mexico RON JOHNSON, Wisconsin
JOHN HICKENLOOPER, Colorado SHELLEY MOORE CAPITO, West
RAPHAEL WARNOCK, Georgia Virginia
RICK SCOTT, Florida
CYNTHIA LUMMIS, Wyoming
David Strickland, Staff Director
Melissa Porter, Deputy Staff Director
George Greenwell, Policy Coordinator and Security Manager
John Keast, Republican Staff Director
Crystal Tully, Republican Deputy Staff Director
Steven Wall, General Counsel
C O N T E N T S
----------
Page
Hearing held on July 27, 2021.................................... 1
Statement of Senator Cantwell.................................... 1
GAO report dated December 18, 2018, entitled, ``Critical
Infrastructure Protection Actions Needed''................. 2
New York Times article dated May 14, 2021 entitled,
``Pipeline Attack Yields Urgent Lessons About U.S.
Cybersecurity'' by David E. Sanger and Nicole Perlroth..... 57
Article dated May 11, 2021, entitled, ``Colonial Pipeline
hack highlights grid disruption risks even with IT-focused
cyberattack, analysts say'' by Robert Walton, Reporter,
Utility Dive............................................... 60
Article dated May 13, 2021, entitled, ``Colonial Pipeline
Cyber Attack Highlights Need For More Seriousness In Energy
Policy'' by David Blackmon, Senior Editor, Shale Magazine.. 86
Article dated June 18, 2018, entitled, ``Cyber security rules
needed for pipelines: FERC commissioners'' by Neil
Chatterjee, Richard Glick, Federal Energy Regulatory
Commission................................................. 89
Statement of Senator Wicker...................................... 55
Statement of Senator Klobuchar................................... 94
Statement of Senator Thune....................................... 96
Statement of Senator Fischer..................................... 98
Statement of Senator Markey...................................... 99
Statement of Senator Blumenthal.................................. 101
Statement of Senator Blackburn................................... 103
Statement of Senator Capito...................................... 105
Statement of Senator Rosen....................................... 107
Statement of Senator Tester...................................... 109
Statement of Senator Hickenlooper................................ 110
Statement of Senator Scott....................................... 112
Statement of Senator Warnock..................................... 114
Witnesses
Hon. David P. Pekoske, Administrator, Transportation Security
Administration................................................. 65
Prepared statement........................................... 67
Hon. Polly Trottenberg, Deputy Secretary, Department of
Transportation................................................. 70
Prepared statement........................................... 72
Leslie V. Gordon, Acting Director, Homeland Security and Justice,
Government Accountability Office............................... 74
Prepared statement........................................... 75
Appendix
Response to written questions submitted to Hon. David P. Pekoske
by:
Hon. Maria Cantwell.......................................... 119
Hon. Kyrsten Sinema.......................................... 120
Hon. Ben Ray Lujan........................................... 122
Hon. Marsha Blackburn........................................ 123
Response to written questions submitted to Hon. Polly Trottenberg
by:
Hon. Maria Cantwell.......................................... 123
Hon. Tammy Duckworth......................................... 125
Hon. Kyrsten Sinema.......................................... 126
Hon. Ron Johnson............................................. 129
Response to written questions submitted to Leslie V. Gordon by:
Hon. Marsha Blackburn........................................ 130
PIPELINE CYBERSECURITY:
PROTECTING CRITICAL INFRASTRUCTURE
----------
TUESDAY, JULY 27, 2021
U.S. Senate,
Committee on Commerce, Science, and Transportation,
Washington, DC.
The Committee met, pursuant to notice, at 10 a.m. in room
SR-253, Russell Senate Office Building, Hon. Maria Cantwell,
Chairwoman of the Committee, presiding.
Present: Senators Cantwell [presiding], Klobuchar,
Blumenthal, Markey, Tester, Rosen, Hickenlooper, Warnock,
Wicker, Thune, Fischer, Blackburn, Capito, and Scott.
OPENING STATEMENT OF HON. MARIA CANTWELL,
U.S. SENATOR FROM WASHINGTON
The Chairman. Good morning. The Senate Committee on
Commerce, Science, and Transportation will come to order. We
very much appreciate the witnesses being here.
Earlier this year the ransomware attack on Colonial
Pipeline caused the company to shut down its pipeline system
that supplies nearly 50 percent of fuel to the East Coast. This
resulted in gas shortages causing spikes, causing prices to
spike and panic buying from Georgia to New York.
Although service was restored within a week, the incident
underscores the potential consequence of any single cyber
attack can have on our daily lives and the need to better
manage and bolster our cybersecurity for our critical
infrastructure.
Our nation relies on more than 2.8 million miles of
pipeline, 140,000 miles of railroad track, four million miles
of roads, 11 million trucks, airport supports, and the
infrastructure increasingly depends on information technology
systems, electronic data that is very susceptible to cyber
threats.
The Colonial Pipeline attack is, frankly, the tip of the
iceberg. Our country is seeing 4,000 ransomware attacks every
single day and since the start of the coronavirus pandemic, the
FBI reported that cyber attacks have increased over 300
percent.
The rapid growth in the number of sophisticated cyber
attacks is an alarm bell ringing about the need to immediately
bolster cybersecurity of our critical infrastructure.
If we don't, it will only be a matter of time before we see
another crippling cyber incident that will have an even more
catastrophic impact on what we saw with Colonial Pipeline and
the pipelines are not the only vulnerable infrastructure in
this country that is vulnerable to this level of serious
disruption.
For years experts have been worried about the vulnerability
of our Nation's grid to the disruptions from nefarious actors,
including from cyber attacks.
I want to enter into the record ``Critical Infrastructure
Protection Actions Needed'' that was a GAO report that was done
in December 2018.
(The information referred to follows]
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
December 18, 2018
Congressional Requesters
The security of the Nation's pipeline systems is vital to public
confidence and the Nation's safety, prosperity, and well-being. More
than 2.7 million miles of pipeline transport and distribute the oil,
natural gas, and other hazardous liquids that U.S. citizens and
businesses depend on to operate vehicles and machinery, heat homes,
generate electricity, and manufacture products. The interstate pipeline
system runs through remote, as well as highly populated urban areas,
and is vulnerable to accidents, operating errors, and malicious
attacks. In addition, pipelines increasingly rely on sophisticated
networked computerized systems and electronic data, which are
vulnerable to cyber attack or intrusion.
Given that many pipelines transport volatile, flammable, or toxic
oil and liquids, and given the potential consequences of a successful
physical or cyber attack on life, property, the economy, and the
environment, pipeline systems are attractive targets for terrorists,
hackers, foreign nations, criminal groups, and others with malicious
intent. For example, according to the Transportation Security
Administration (TSA)--the Federal agency with responsibility for
security in all modes of transportation, which includes the oversight
of pipeline physical security and cybersecurity--a minor pipeline
system disruption could result in commodity price increases while
prolonged pipeline disruptions could lead to widespread energy
shortages.\1\ Further, disruption of any magnitude may affect other
domestic critical infrastructure and industries that are dependent on
pipeline system commodities.
---------------------------------------------------------------------------
\1\ Transportation Security Administration, Biennial National
Strategy for Transportation Security: Report to Congress (Washington,
D.C.: Apr. 4, 2018).
---------------------------------------------------------------------------
Since the September 11, 2001, terrorist attacks, new threats to the
Nation's pipeline systems have evolved to include sabotage by
environmental activists and cyber attack or intrusion by nations.\2\ In
October 2016, environmental activists forced the shutdown of five crude
oil pipelines in four states.\3\ In addition, the U.S. energy sector
has experienced cyber intrusions by nation-state actors into their
networks. For example, in March 2018, the Federal Bureau of
Investigation and the National Cybersecurity and Communications
Integration Center (NCCIC) reported that a nation-state had targeted
organizations within multiple U.S. critical infrastructure sectors,
including the energy sector, and collected information pertaining to
Industrial Control Systems (ICS).\4\ Also, in April 2012, the
Industrial Control Systems Cyber Emergency Response Team reported that
an unidentified cyber attacker had conducted a series of cyber
intrusions into U.S. natural gas pipeline systems beginning in December
2011.\5\
---------------------------------------------------------------------------
\2\ Nations, including nation-state, state-sponsored, and state-
sanctioned programs, use cyber tools as part of their information-
gathering and espionage activities. In addition, several nations are
aggressively working to develop information warfare doctrine, programs,
and capabilities.
\3\ Congressional Research Service, Pipeline Security: Recent
Attacks, IN106103 (Washington, D.C.: Apr. 11, 2017).
\4\ Federal Bureau of Investigation and National Cybersecurity and
Communications Integration Center, Russian Government Cyber Activity
Targeting Energy and Other Critical Infrastructure Sectors, TA18-074A
(Washington, D.C.: Mar., 16, 2018 (revised)). Industrial control
systems include software-based systems used to monitor and control many
aspects of network operation for pipeline networks.
\5\ Industrial Control Systems Cyber Emergency Response Team (ICS-
CERT), ICS-CERT Monthly Monitor (Washington, D.C.: Apr. 2012).
---------------------------------------------------------------------------
The security of Federal cyber assets has been on our High Risk list
since 1997 and was expanded to include the protection of critical cyber
infrastructure in 2003.\6\ In September 2018, we issued an update to
the information security high-risk area that identified actions needed
to address cybersecurity challenges facing the Nation.\7\ We last
reported on pipeline security in 2010 and made eight recommendations to
TSA to develop outcome-based performance measures for assessing TSA's
pipeline security efforts, and to track its corporate security reviews
and critical facility inspections' recommendations,\8\ among others.\9\
We discuss some of these recommendations in more detail later in this
report. In 2012, we reviewed information provided by TSA and closed the
recommendations as implemented.
---------------------------------------------------------------------------
\6\ Our biennial High Risk List identifies government programs that
have greater vulnerability to fraud, waste, abuse, and mismanagement or
need to address challenges to economy, efficiency, or effectiveness. We
have designated Federal information security as a High Risk area since
1997; in 2003, we expanded this high risk area to include protecting
systems supporting our Nation's critical infrastructure; and, in 2015,
we further expanded this area to include protecting the privacy of
personally identifiable information that is collected, maintained, and
shared by both Federal and nonfederal entities. See GAO, High Risk
Series: Progress on Many High Risk Areas, While Substantial Efforts
Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017).
\7\ GAO, High Risk Series: Urgent Actions Are Needed to Address
Cybersecurity Challenges Facing the Nation, GAO-18-622 (Washington,
D.C.: Sept. 6, 2018).
\8\ TSA conducts two types of pipeline security reviews: Corporate
Security Reviews and Critical Facility Security Reviews. Corporate
Security Reviews are voluntary on-site reviews of a pipeline owner's
corporate policies and procedures. Critical Facility Security Reviews
are voluntary on-site inspections of critical pipeline facilities, as
well as other select pipeline facilities, throughout the Nation.
Critical Facility Inspections were the predecessor to Critical Facility
Security Reviews.
\9\ GAO, Pipeline Security: TSA Has Taken Actions to Help
Strengthen Security, but Could Improve Priority-Setting and Assessment
Processes, GAO-10-867 (Washington, D.C.: Aug. 2010).
---------------------------------------------------------------------------
You requested that we review TSA's efforts to enhance pipeline
physical security and cybersecurity. This report examines the following
objectives:
1. how do pipeline sector stakeholders share security-related
information;
2. what guidance do pipeline operators report using to address
security risks and to what extent does TSA ensure its
guidelines reflect the current threat environment;
3. to what extent has TSA assessed security risks to pipeline
systems; and
4. to what extent has TSA assessed its effectiveness in reducing
pipeline security risks.
For each objective, we interviewed representatives of the five
major associations with ties to the pipeline industry: the American
Petroleum Institute (API), the Association of Oil Pipe Lines, the
American Gas Association (AGA), the Interstate Natural Gas Association
of America (INGAA), and the American Public Gas Association. We also
interviewed a nonprobability sample of security personnel from 10
pipeline operators. We selected the 10 pipeline operators from TSA's
list of the top 100 critical pipeline systems.\10\ We chose operators
to ensure a mixture of the following characteristics: (a) type of
pipeline commodity transported (i.e., natural gas or hazardous oil and
liquids); (b) volume of product transported; and (c) whether or not the
pipeline operators' critical facilities had been the subject of a TSA
security review. We also considered the location of selected operators'
pipeline systems to ensure that a single state or region was not
overrepresented in our sample. We then conducted semistructured
interviews to obtain operators' perspectives on pipeline security and
the role of Federal agencies in assisting operators with security
activities. While the information gathered during operator interviews
cannot be generalized to all pipeline operators, it provides a range of
perspectives on a variety of topics relevant to pipeline security.
---------------------------------------------------------------------------
\10\ According to TSA, a system is considered critical if it is so
vital to the United States that its incapacitation or destruction would
have a debilitating effect on security, national economic security,
public health or safety, or any combination thereof. TSA determines the
top 100 most critical pipeline systems based on the amount of hazardous
liquid or natural gas product transported through a pipeline in 1 year.
---------------------------------------------------------------------------
To identify how pipeline sector stakeholders share security-related
information, we reviewed documents describing Federal agencies'
processes for sharing security-related information with Federal
partners and private industry. In addition, we reviewed relevant
documents from TSA and other Federal entities, including the Department
of Transportation (DOT), DOT's Pipeline and Hazardous Materials Safety
Administration (PHMSA), the Department of Energy (DOE), and the Federal
Energy Regulatory Commission (FERC). We also interviewed agency and
industry officials to gather their perspectives on how security
information is shared among pipeline sector stakeholders.
To identify the guidance pipeline operators report using to address
security risks and the extent to which TSA ensures its guidelines
reflect the current threat environment, we reviewed TSA's 2018 Pipeline
Security Guidelines\11\ and compared the cybersecurity-related sections
to applicable standards of the National Institute of Standards and
Technology's (NIST) Framework for Improving Critical Infrastructure
Cybersecurity.\12\ We also interviewed Federal officials to identify
security-related standards and guidance issued. In addition, we
obtained from industry officials the security-related standards and
guidance they use and asked them about any challenges they experienced
in implementing TSA's Pipeline Security Guidelines. Based on the
results of our operator interviews, we analyzed TSA data on critical
facility identification. Further, to assess TSA's process for updating
the guidelines, we compared the process with TSA's Pipeline Security
Smart Practice Observations for pipeline operators and our Standards
for Internal Control in the Federal Government.\13\
---------------------------------------------------------------------------
\11\ Transportation Security Administration, Pipeline Security
Guidelines (March 2018).
\12\ National Institute of Standards and Technology, Framework for
Improving Critical Infrastructure Cybersecurity, Version 1.0
(Gaithersburg, Md.: Feb. 12, 2014). In response to Executive Order
13636, NIST issued the Framework for Critical Infrastructure
Cybersecurity, which is intended to help organizations apply the
principles and best practices of risk management to improving the
security and resilience of critical infrastructure. The framework
consists of five concurrent and continuous functions: identify,
protect, detect, respond, and recover. When considered together, these
functions provide a high-level, strategic view of the life cycle of an
organization's management of cybersecurity risk.
\13\ GAO, Standards for Internal Control in the Federal Government,
GAO-14-704G (Washington, D.C.: Sept. 10, 2014).
---------------------------------------------------------------------------
To determine the extent TSA has assessed security risks to
pipelines, we reviewed key threat assessments from TSA, such as its
Pipeline Modal and Cyber Modal Threat Assessments and Transportation
Sector Security Risk Assessments that it issued during calendar years
2011 through 2017. We also evaluated TSA's identification of the 100
most critical pipeline systems, its methods for assessing relative risk
among those systems, and its prioritization of its pipeline reviews. As
part of that evaluation, we assessed the reliability of the data within
TSA's pipeline relative risk ranking tool by performing electronic and
manual checks for such things as logic errors and missing data.\14\
Additionally, we interviewed TSA officials about how the risk tool is
updated and maintained to ensure data reliability. We determined the
data were sufficiently reliable for the purpose of our review. We also
interviewed TSA officials about the methods they used to rank relative
risk among pipeline systems and the extent to which those methods
aligned with the National Infrastructure Protection Plan 2013:
Partnering for Critical Infrastructure Security and Resilience
(NIPP),\15\ other Department of Homeland Security (DHS) priorities, and
previously identified best practices for program management and risk
assessment. We also analyzed information on the number of pipeline
security reviews--Corporate Security Reviews (CSR) and Critical
Facility Security Reviews (CFSR)--that TSA conducted by Fiscal Year, as
well as TSA staffing levels and contractor support. Further, we
interviewed TSA officials about their staffing allocation and workforce
planning process and compared TSA's process to our previous work which
identified principles that a strategic workforce planning process
should follow.\16\
---------------------------------------------------------------------------
\14\ To assess the security risks of the top 100 critical pipeline
systems, TSA's Pipeline Security Branch developed its Pipeline Relative
Risk Ranking Tool (risk assessment) in 2007. The risk assessment
calculates threat, vulnerability, and consequence on variables such as
the amount of throughput in the pipeline system.
\15\ Department of Homeland Security, 2013 National Infrastructure
Protection Plan, Partnering for Critical Infrastructure Security and
Resilience (Washington, D.C.: December 2013).
\16\ GAO, Human Capital: Key Principles for Effective Strategic
Workforce Planning, GAO-04-39 (Washington, D.C.: Dec. 11, 2003).
---------------------------------------------------------------------------
To further our understanding of TSA's pipeline security review
processes, we observed TSA officials and contractors conduct one CSR of
one pipeline system, and three CFSRs at three critical facilities in
the Houston and Beaumont, Texas, areas. While the results of our
observations cannot be generalized to all CSRs and CFSRs or all
pipeline systems and critical facilities, they provided us with an
understanding of how TSA conducts these reviews and inspections. We
also interviewed representatives of Secure Solutions International--a
security and risk management consulting firm that assists TSA in
conducting CSRs and CFSRs--about critical facilities and the inspection
process.
To determine the extent TSA has assessed its effectiveness in
reducing pipeline security risks, we assessed key strategic documents,
such as TSA's performance report, against our key characteristics of
effective performance measures.\17\ We also reviewed TSA guidance, such
as the standard operating procedures outlining how TSA staff are to
conduct pipeline security reviews and monitor operators' implementation
of their recommendations. We then compared TSA's assessment efforts to
our Standards for Internal Control in the Federal Government. In
addition, we evaluated the databases TSA officials reported using to
analyze and record the results and recommendations of pipeline security
reviews. We reviewed each database to determine what information was
stored in them, such as the number of observations, what fields were
present, and typical entries within each field. We then reviewed and
conducted electronic testing on the universe of fields and
observations. Although we identified limitations, which we discuss
later in the report, we found that the data was sufficiently reliable
to provide general information such as summary figures describing
pipeline security reviews completed. We also interviewed TSA officials
to understand TSA's efforts to assess its overall effectiveness in
reducing pipeline security risks and related data collection efforts.
---------------------------------------------------------------------------
\17\ GAO, Tax Administration: IRS Needs to Further Refine Its Tax
Filing Season Performance Measures, GAO-03-143 (Washington, D.C.: Nov.
22, 2002); GAO, Military Personnel: DOD Needs to Establish Performance
Measures for the Armed Forces Sports Program, GAO-17-542 (Washington,
D.C.: June 8, 2017).
---------------------------------------------------------------------------
We conducted this performance audit from June 2017 to December 2018
in accordance with generally accepted government auditing standards.
Those standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Background
Overview of the U.S. Pipeline System
The national pipeline system consists of more than 2.7 million
miles of networked pipelines transporting oil, natural gas, and other
hazardous liquids. Hazardous liquid and natural gas pipelines--
primarily buried underground in the continental United States--run
under remote and open terrain, as well as densely populated areas.
These pipelines are of three main types:
Hazardous liquid: About 216,000 miles of hazardous liquid
pipeline transport crude oil, diesel fuel, gasoline, jet fuel,
anhydrous ammonia, and carbon dioxide.
Natural gas transmission and storage: About 319,000 miles of
pipeline--mostly interstate--transport natural gas from sources
to communities.
Natural gas distribution: About 2.2 million miles of
pipeline--mostly intrastate--transport natural gas from
transmission sites to consumers.
Figure 1 depicts the network of hazardous liquid and natural gas
transmission pipelines in the United States.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
More than 3,000 pipeline companies operate the Nation's pipeline
systems, which can traverse multiple states and the U.S. borders with
Canada and Mexico. Many pipeline systems are comprised of the pipelines
themselves, as well as a variety of facilities, such as storage tanks,
compressor stations, and control centers. Most pipeline systems are
monitored and moderated through automated ICS or Supervisory Control
and Data Acquisition (SCADA) systems using remote sensors, signals, and
preprogramed parameters to activate and deactivate valves and pumps to
maintain flows within tolerances.\18\
---------------------------------------------------------------------------
\18\ SCADA is one type of control system, which is a computer-based
system used within many infrastructures and industries to monitor and
control sensitive processes and physical functions. Control systems
perform functions that range from simple to complex. They can be used
to simply monitor processes--for example, the environmental conditions
in a small office building--or to manage the complex activities of a
municipal water system or a nuclear power plant. Control systems are
vulnerable to cyber-attack from inside and outside the control system
network.
---------------------------------------------------------------------------
Federal agencies and pipeline operators determine the criticality
of pipeline systems and their facilities based on their importance to
the Nation's energy infrastructure; service to installations critical
to national defense; or, if attacked, have the potential to cause mass
casualties and significant impact on public drinking water affecting
major population centers. Accordingly, those determined to be critical
merit increased attention to security. However, as we previously
reported, the inherent design and operation of U.S. pipeline systems
may reduce some potential impacts of lost service.\19\ The pipeline
sector is generally considered to be resilient and versatile.
Historically, pipeline operators have been able to quickly respond to
the adverse consequences of an incident--whether it is damage from a
major hurricane or a backhoe--and quickly restore pipeline service.
Pipeline infrastructure also includes redundancies such as parallel
pipelines or interconnections that enable operators to reroute material
through the network. Figure 2 depicts the U.S. pipeline system, its
basic components, examples of vulnerabilities, and the entities to
which it supplies energy and raw materials. These entities include
utility companies, airports, military sites, and industrial and
manufacturing facilities.
---------------------------------------------------------------------------
\19\ GAO-10-867.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Physical and Cyber Threats to Pipeline Systems
According to TSA, pipelines are vulnerable to physical attacks--
including the use of firearms or explosives--largely due to their
stationary nature, the volatility of transported products, and the
dispersed nature of pipeline networks spanning urban and outlying
areas. The nature of the transported commodity and the potential effect
of an attack on national security, commerce, and public health make
some pipelines and their assets more attractive targets for attack.\20\
Oil and gas pipelines have been and continue to be targeted by
terrorists and other malicious groups globally.\21\ Terrorists have
also targeted U.S. pipelines, but have not succeeded in attacking
them.\22\ Further, environmental activists and lone actors seeking to
halt the construction of new pipelines through sabotage have recently
emerged as a new threat to pipelines.\23\ For example, in March 2017,
activists used blowtorches to cut holes in empty portions of the Dakota
Access Pipeline in two states. In February 2017, local law enforcement
officers fatally shot a man who used an assault rifle to damage the
Sabal Trail Pipeline, a natural gas pipeline under construction in
Florida.
---------------------------------------------------------------------------
\20\ Transportation Security Administration, Biennial National
Strategy for Transportation Security: Report to Congress (Washington,
D.C.: Apr. 4, 2018).
\21\ For example, rebels bombed the Cano Limon oil pipeline and
other pipelines in Colombia more than 600 times since 1993, with the
most recent attack occurring on April 27, 2017. Militants in Nigeria
have repeatedly attacked oil pipelines, including coordinated bombings
of three pipelines in 2007 and the bombing of an underwater pipeline in
2016. Assailants bombed natural gas pipelines in British Columbia,
Canada six times between October 2008 and July 2009, which authorities
later classified as environmentally-motivated. See GAO-10-867 and
Congressional Research Service, Pipelines: Securing the Veins of the
American Economy, TE10009 (Washington, D.C.: Apr. 19, 2016).
\22\ In 2006, Federal authorities acknowledged the discovery of a
detailed posting on a website purportedly linked to al Qaeda that
reportedly encouraged attacks on U.S. pipelines, especially Trans
Alaska Pipeline System, using weapons or hidden explosives. In 2007,
the U.S. Department of Justice arrested members of a terrorist group
planning to attack jet fuel pipelines and storage tanks at the John F.
Kennedy International Airport. In 2011, a man planted a bomb, which did
not detonate, along a natural gas pipeline in Oklahoma. In 2012, a man
unsuccessfully attempted to bomb a natural gas pipeline in Plano,
Texas. See GAO-10-867 and Congressional Research Service, Testimony
TE10009, Pipelines: Securing the Veins of the American Economy, by Paul
W. Parfomak, Apr. 19, 2016.
\23\ Congressional Research Service, Pipeline Security: Recent
Attacks, IN106103 (Washington, D.C.: Apr. 11, 2017).
---------------------------------------------------------------------------
The sophisticated computer systems that pipeline operations rely on
are also vulnerable to various cyber threats.\24\ According to DOE, the
frequency, scale, and sophistication of cyber threats have increased,
and attacks have become easier to launch. NCCIC reported that the
energy sector, which includes pipelines, experienced more cyber
incidents than any sector from 2013 to 2015, accounting for 35 percent
of the 796 incidents reported by all critical infrastructure sectors.
In 2016, NCCIC reported that the energy sector was the third most
frequently attacked sector.\25\ Further, according to DOE, the cost of
preventing and responding to cyber incidents in the energy sector is
straining the ability of companies to adequately protect their critical
cyber systems.\26\ For example, a 2015 study by the Ponemon Institute
estimated the annualized cost of cyber crime for an average energy
company to be about $28 million.\27\
---------------------------------------------------------------------------
\24\ Once accessible to an attacker, a SCADA system can be
exploited in a number of specific ways to carry out a cyber attack:
issuing unauthorized commands to control equipment; sending false
information to a control-system operator that initiates inappropriate
actions; disrupting control system operation by delaying or blocking
the flow of information through the control network; making
unauthorized changes to control system software to modify alarm
thresholds or other configuration settings; and rendering resources
unavailable by propagating malicious software (e.g., a virus, worm,
Trojan horse) through the control network. Congressional Research
Service, Cybersecurity for Energy Delivery Systems, R44939 (Washington,
D.C.: Aug. 28, 2017).
\25\ NCCIC collects data on cyber incidents that attempt to gain
access to both business and control systems infrastructure. These
incidents, reported on a voluntary basis by critical infrastructure
owners and operators, include, for example, unauthorized access to
SCADA devices or exploitation of software vulnerabilities. NCCIC
reports data on critical infrastructure sectors, such as energy, but
does not report data on subsectors, such as pipelines.
\26\ Department of Energy, Office of Electricity Delivery and
Reliability, Multiyear Plan for Energy Sector Cybersecurity, 2018
(Washington, D.C.: Mar. 2018).
\27\ Ponemon Institute, 2015 Cost of Cyber Crime Study: United
States, 2016.
---------------------------------------------------------------------------
Ineffective protection of cyber assets from these threats can
increase the likelihood of security incidents and cyber attacks that
disrupt critical operations; lead to inappropriate access to and
disclosure, modification, or destruction of sensitive information; and
threaten national security, economic well-being, and public health and
safety. Unintentional or nonadversarial threat sources may include
failures in equipment or software due to aging, resource depletion, and
errors made by end users. They also include natural disasters and
failures of critical infrastructure on which the organization depends,
but that are outside of the control of the organization.
Intentional or adversarial threats may include corrupt employees,
criminal groups, terrorists, and nations that seek to leverage the
organization's dependence on cyber resources (i.e., information in
electronic form, information and communications technologies, and the
communications and information-handling capabilities provided by those
technologies). These threat adversaries vary in terms of their
capabilities, their willingness to act, and their motives, which can
include seeking monetary gain or seeking an economic, political, or
military advantage.
Cyber threat adversaries make use of various techniques, tactics,
practices, and exploits to adversely affect an organization's
computers, software, or networks, or to intercept or steal valuable or
sensitive information. For example, an attacker could infiltrate a
pipeline's operational systems via the Internet or other communication
pathways to potentially disrupt its service and cause spills, releases,
explosions, or fires.\28\ Moreover, ICS, which were once largely
isolated from the Internet and the company's information technology
systems, are increasingly connected in modern energy systems, allowing
cyber attacks to originate in business systems and migrate to
operational systems. For example, malicious nation-state actors used
spear-phishing\29\ and other similar approaches in 2018 against energy
sector organizations to gain access to their business systems, conduct
reconnaissance, and collect information about their ICS.\30\ Similarly,
in April 2012, the Industrial Control Systems Cyber Emergency Response
Team reported that an unidentified cyber attacker had conducted a
series of cyber intrusions into U.S. natural gas pipeline systems
beginning in December 2011.\31\
---------------------------------------------------------------------------
\28\ In 2007, researchers working with DHS conducted an experiment
to prove such an attack is possible by sending two sets of commands to
a diesel-fueled electric generator, which caused the generator to
destroy itself without the operators knowing. In addition, according to
DOE, in 2015, unidentified attackers used spear phishing e-mails to
gain access to three Ukrainian utilities' information technology
networks resulting in power loss for 225,000 customers for several
hours. Once inside, among other things, they stole credentials and
hijacked the distribution management system to systematically open
breakers and cause a power outage. The attackers then accessed the
industrial control system network and disabled the uninterruptible
power supply, operational control systems, and computers and prevented
infected computers from rebooting.
\29\ ``Spear-phishing'' involves sending official-looking e-mails
to specific individuals to insert harmful software programs (malware)
into protected computer systems; to gain unauthorized access to
proprietary business information; or to access confidential data such
as passwords, social security numbers, and private account numbers.
\30\ NCCIC and the Federal Bureau of Investigation characterized
the intrusions as a multi-stage intrusion campaign by an identified
nation state's actors on U.S. Government entities and organizations
within the energy, nuclear, commercial facilities, water, aviation, and
critical manufacturing sectors. According to the agencies, the campaign
targeted small commercial facilities' networks where they staged
malware, conducted spear phishing, and gained remote access into energy
sector networks. After obtaining access, the actors conducted network
reconnaissance, moved laterally, and collected information pertaining
to industrial control systems. Federal Bureau of Investigation and
National Cybersecurity and Communications Integration Center, Russian
Government Cyber Activity Targeting Energy and Other Critical
Infrastructure Sectors TA18-074A (Washington, D.C.: Mar., 16 2018
(revised)).
\31\ Industrial Control Systems Cyber Emergency Response Team (ICS-
CERT), ICS-CERT Monthly Monitor (Washington, D.C.: Apr. 2012).
---------------------------------------------------------------------------
Key Critical Infrastructure Protection Guidance and Presidential
Directives
Federal policy and public-private plans establish roles and
responsibilities for the protection of critical infrastructure,
including pipelines. These include Presidential Policy Directive 21
(PPD-21), the NIPP, and Executive Order 13636. PPD-21, issued in
February 2013, reflects an all-hazards approach to protecting critical
infrastructure, including natural disasters, terrorism, and cyber
incidents.\32\ The directive also identifies the 16 critical
infrastructure sectors\33\ and assigns roles and responsibilities for
each critical infrastructure sector among nine designated Federal
sector-specific agencies.\34\
---------------------------------------------------------------------------
\32\ White House, Presidential Policy Directive/PPD-21: Critical
Infrastructure Security and Resilience (Washington, D.C.: Feb. 12,
2013). The term ``all-hazards'' is defined by the directive as a threat
or an incident, natural or manmade, which warrants action to protect
life, property, the environment, and public health or safety, and to
minimize disruptions of government, social, or economic activities.
''All-hazards,'' as further defined in the directive, includes natural
disasters, cyber incidents, industrial accidents, pandemics, acts of
terrorism, sabotage, and destructive criminal activity targeting
critical infrastructure.
\33\ The 16 critical infrastructure sectors are Chemical;
Commercial Facilities; Communications; Critical Manufacturing; Dams;
Defense Industrial Base; Emergency Services; Energy; Financial
Services; Food and Agriculture; Government Facilities; Health Care and
Public Health; Information Technology; Nuclear Reactors, Materials, and
Waste; Transportation Systems; and Water and Wastewater Systems.
\34\ PPD-21 was developed to advance a national unity of effort to
strengthen and maintain secure, functioning, and resilient critical
infrastructure. It defines resilience as the ability to prepare for and
adapt to changing conditions and withstand and recover rapidly from
disruptions, and includes the ability to withstand and recover from
deliberate attacks, accidents, or naturally occurring threats or
incidents. Stated another way, resilience can reduce the consequences
associated with an incident, event, or occurrence. Resilience is an
area that may be included in vulnerability assessments to determine the
extent to which critical infrastructure is prepared to withstand and
recover from disruptions. Such disruptions could include exposure to a
given hazard or incidents arising from the deliberate exploitation of
vulnerabilities of sector-specific strategies, policies, activities,
and issues.
---------------------------------------------------------------------------
While PPD-21 identified the critical infrastructure sectors and
assigned responsibility for each sector's sector-specific agency, the
NIPP outlines critical infrastructure stakeholder roles and
responsibilities regarding critical security and resilience. It
describes a voluntary partnership model as the primary means of
coordinating government and private sector efforts to protect critical
infrastructure. As part of the partnership structure, the designated
sector-specific agencies serve as the lead coordinators for security
programs of their respective sector. As sector-specific agencies,
Federal departments or agencies lead, facilitate, or support the
security and resilience programs and associated activities of their
designated critical infrastructure sector. For example, DHS and DOT are
both designated as sector-specific agencies for the transportation
systems sector, which includes pipelines. Each sector also has a
government coordinating council,\35\ consisting of representatives from
various levels of government, and many have a sector coordinating
council (SCC) consisting of owner-operators of these critical assets or
members of their respective trade associations.\36\ For example, the
Transportation Government Coordinating Council has been established,
and the Pipeline Modal SCC has been established to represent pipeline
operators.\37\
---------------------------------------------------------------------------
\35\ Government coordinating councils coordinate strategies,
activities, policy, and communications across government entities
within each sector and consist of representatives across various levels
of government (i.e., federal, state, local, and tribal) as appropriate.
For example, DHS and DOE are designated as the co-chairs of the Energy
Government Coordinating Council.
\36\ SCCs are self-organized, self-run, and self-governed private
sector councils that interact on a wide range of sector-specific
strategies, policies, and activities. SCC membership can vary from
sector to sector, but is meant to be representative of a broad base of
owners, operators, associations, and other entities--both large and
small--within the sector.
\37\ Pipeline operators may also participate in the Oil and Natural
Gas Subsector Coordinating Council of the Energy SCC.
---------------------------------------------------------------------------
The NIPP also outlines a risk management framework for critical
infrastructure protection. As shown in Figure 3, the NIPP uses a risk
management framework as a planning methodology intended to inform how
decision makers take actions to manage risk. The risk management
framework calls for public and private critical infrastructure partners
to conduct risk assessments to understand the most likely and severe
incidents that could affect their operations and communities, and use
this information to support planning and resource allocation.
According to DHS, the risk management framework is influenced by
the nature and magnitude of a threat, the vulnerabilities to that
threat, and the consequences that could result, as shown in Figure 4.
a As noted in DHS's Risk Management Fundamentals
Doctrine, risk is generally recognized as a function of threats,
vulnerabilities, and consequences--elements that may explicitly be
considered for many homeland security risks, such as those related to
infrastructure protection. Risk Management Fundamentals, Homeland
Security Risk Management Doctrine (Washington, D.C.: April 2011).
Federal policy has encouraged voluntary information-sharing
mechanisms between the Federal government and critical infrastructure
owners and operators.\38\ For example, Information Sharing and Analysis
Centers (ISAC) are formed by critical infrastructure owners and
operators to gather, analyze, appropriately sanitize, and disseminate
intelligence and information related to critical infrastructure. They
typically collect, analyze and disseminate actionable threat
information to their members and provide members with tools to mitigate
risks and enhance resiliency. ISACs in which pipeline operators may
participate have been formed including the Oil and Natural Gas ISAC,
Downstream Natural Gas ISAC, and Electricity ISAC.
---------------------------------------------------------------------------
\38\ Among other things, Presidential Decision Directive 63, for
example, encouraged the development of ISACs to serve as mechanisms for
gathering, analyzing, and disseminating information on cyber
infrastructure threats and vulnerabilities to and from owners and
operators of the sectors and the Federal government. White House,
Presidential Decision Directive 63: Critical Infrastructure Protection:
Sector Coordinators, (Washington, D.C.: May 22, 1998). Presidential
Decision Directive 63 has been superseded by Homeland Security Policy
Directive 7, which was revoked by PPD-21.
---------------------------------------------------------------------------
Finally, in February 2013, the president issued Executive Order
13636, Improving Critical Infrastructure Cybersecurity, which cited
repeated cyber intrusions into critical infrastructure as demonstrating
the need for improved cybersecurity.\39\ Executive Order 13636 outlined
actions for improving critical infrastructure cybersecurity, including
direction for the National Institute of Standards and Technology (NIST)
to lead the development of a voluntary risk-based cybersecurity
framework that would comprise a set of industry standards and best
practices to help organizations manage cybersecurity risks.\40\ NIST
issued the framework in 2014 and updated it in April 2018.\41\ The
order also addressed the need to improve cybersecurity information
sharing and collaboratively develop risk-based standards and stated
that U.S. policy was to increase the volume, timeliness, and quality of
cyber threat information shared with private sector entities so that
these entities may better protect and defend themselves against cyber
threats.
---------------------------------------------------------------------------
\39\ Exec. Order No. 13636 (Feb. 12, 2013), 78 Fed. Reg. 11,737
(Feb. 19, 2013). Executive Order 13800, Strengthening the Cybersecurity
of Federal Networks and Critical Infrastructure, issued in May 2017,
directs the Secretary of Homeland Security, in coordination with the
heads of other appropriate departments and agencies, to among other
things, identify authorities and capabilities that agencies could use
to support the cybersecurity efforts of critical infrastructure
entities identified pursuant to section 9 of Executive Order 13636 to
be at greatest risk of attack that could result in catastrophic results
on public health or safety, economic security, or national security.
See Exec. Order No. 13800 (May 11, 2017), 82 Fed. Reg. 22,391 (May 16,
2017).
\40\ Exec. Order No. 13636, 78 Fed. Reg. at 11,740-41. The National
Institute of Standards and Technology (NIST) is a standards-setting
agency under the U.S. Department of Commerce.
\41\ National Institute of Standards and Technology, Framework for
Improving Critical Infrastructure Cybersecurity (Feb. 12, 2014);
Framework for Improving Critical Infrastructure Cybersecurity Version
1.1 (Apr. 16, 2018).
---------------------------------------------------------------------------
Pipeline Stakeholders' Security Roles and Responsibilities
Protecting the Nation's pipeline systems is a responsibility shared
by both the Federal government and private industry. As a result,
several Federal departments, agencies, and the private sector have
significant roles in pipeline physical and cyber-related security.
These entities include the following:
Transportation Security Administration (TSA). TSA, within DHS, has
primary oversight responsibility for the physical security and
cybersecurity of transmission and distribution pipeline systems.\42\
Within TSA, the Security Policy and Industry Engagement's Pipeline
Security Branch is charged with overseeing its pipeline security
program. Pursuant to its authority, TSA's Pipeline Security Branch
first issued its voluntary Pipeline Security Guidelines in 2011, and
released revised guidelines in March 2018.\43\ In accordance with the
9/11 Commission Act, TSA's Pipeline Security Branch identifies the top
100 critical pipeline systems in the Nation.\44\ To do so, it uses
system annual throughput, which is based on the amount of hazardous
liquid or natural gas product transported through a pipeline in 1 year
(i.e., annual throughput). TSA also ranks the relative risk among the
top 100 critical pipeline systems, discussed later in the report.
Additionally, TSA's Pipeline Security Branch is responsible for
conducting voluntary Corporate Security Reviews (CSR) and Critical
Facility Security Reviews (CFSR), which assess the extent to which the
100 most critical pipeline systems are following the intent of TSA's
Pipeline Security Guidelines.\45\ See figure 5 below for an overview of
the CSR and CFSR processes.
---------------------------------------------------------------------------
\42\ Pursuant to the Aviation and Transportation Security Act, TSA
is the Federal entity with responsibility for security in all modes of
transportation, which includes the Nation's interstate pipeline
systems. See Pub. L. No. 107-71, 115 Stat.597 (2001); 49 U.S.C.
Sec. 114(d).
\43\ The Implementing Recommendations of the 9/11 Commission Act of
2007 (9/11 Commission Act) directs the Secretary of Homeland Security,
in conjunction with the Secretary of Transportation, to develop and
transmit to pipeline operators security recommendations for natural gas
and hazardous liquid pipelines and pipeline facilities and, if deemed
appropriate, shall promulgate regulations and carry out necessary
inspection and enforcement actions. See Pub. L. No. 110-53,
Sec. 1557(d), 121 Stat. 266, 475-76; 6 U.S.C. Sec. 1207(d). TSA has not
issued regulations for the pipeline sector under this authority but
instead relies on voluntary compliance with the agency's security
guidelines and best practice recommendations.
\44\ See 6 U.S.C. Sec. 1207(b). According to Pipeline Security
Branch officials, even though there are over 3,000 pipeline operators
in the U.S., the top 100 critical pipeline systems in the country
represent approximately 85 percent of the energy in the Nation.
\45\ CSRs are voluntary on-site reviews of a pipeline owner's
corporate policies and procedures. CFSRs are voluntary onsite reviews
of critical pipeline facilities, as well as other selected pipeline
facilities throughout the Nation. TSA requests selected operators to
participate in these reviews, but operators can decline to participate.
However, according to TSA officials, no operator has declined to
participate in a CSR or CFSR.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
a TSA uses system annual throughput in determining the
top 100 critical pipeline system, which is based on the amount of
hazardous liquid or natural gas product transported through a pipeline
in 1 year (i.e., annual throughput measured in therms). Also, some
pipeline operators own or operate more than one of the 100 most
critical systems.
b Because of the voluntary nature of TSA's pipeline
security program, TSA requests selected operators to participate in its
pipeline security reviews--the CSR and CFSR. An operator may choose not
to participate in these reviews. However, according to TSA officials,
no operator has declined to participate in a CSR or CFSR to date.
c Under TSA's Pipeline Security Guidelines, pipeline
operators are to self-identify the critical facilities within their
pipeline system and report their critical facilities to TSA. However,
operators may identify no critical facilities in their systems.
In addition, TSA Intelligence and Analysis is responsible for
collecting and analyzing threat information related to the
transportation network, and sharing relevant threat information to
pipeline stakeholders.
National Cybersecurity and Communications Integration Center
(NCCIC). Within DHS, NCCIC assists critical infrastructure owners in
addressing cyber incidents and attacks, including those targeting
industrial control systems.\46\ The NCCIC's mission is to reduce the
likelihood and severity of incidents that may significantly compromise
the security and resilience of the Nation's critical information
technology and communications networks.\47\ NCCIC's role is to serve as
the Federal civilian interface for sharing information related to
cybersecurity risks, incidents, analysis, and warnings with Federal and
nonfederal entities, and to provide shared situational awareness to
enable real-time actions to address cybersecurity risks and incidents
to Federal and nonfederal entities.
---------------------------------------------------------------------------
\46\ According to NCCIC officials, NCCIC is in the process of an
organizational realignment. When completed, the United States Cyber
Emergency Team and the Industrial Control Systems Cyber Emergency Team
will be consolidated into a single entity within NCCIC.
\47\ National Security Presidential Directive 54 (Homeland Security
Presidential Directive/HSPD-23), issued on January 8, 2008, established
the Comprehensive National Cybersecurity Initiative, which is aimed at
safeguarding Federal civilian Executive Branch government information
systems. Pursuant to the directive, DHS established the NCCIC in
October 2009.
---------------------------------------------------------------------------
Pipeline and Hazardous Materials Safety Administration (PHMSA).
PHMSA, within DOT, is responsible for regulating the safety of
hazardous materials transportation and the safety of pipeline systems,
some aspects of which can be related to pipeline security.\48\ In 2004,
PHMSA and TSA entered into a memorandum of understanding regarding
their respective roles in all modes of transportation. In 2006, they
signed an annex to the memorandum of understanding that further
delineates lines of authority and responsibility between TSA and PHMSA
on pipeline and hazardous materials transportation security. The annex
identifies TSA as the lead Federal entity for transportation security,
including hazardous materials and pipeline security, and PHMSA as
responsible for administering a national program of safety in natural
gas and hazardous liquid pipeline transportation, including identifying
pipeline safety concerns and developing uniform safety standards.
---------------------------------------------------------------------------
\48\ The Homeland Security Act of 2002, enacted in November 2002,
established DHS, transferred TSA from DOT to DHS, and assigned DHS
responsibility for protecting the Nation from terrorism, which includes
securing the Nation's transportations systems. See Pub. L. No. 107-296,
116 Stat. 2135 (2002). Primary responsibility for regulating the safety
of hazardous materials transportation via pipeline and the safety of
pipeline systems remained with DOT. See e.g., 49 C.F.R. pts. 190-199.
---------------------------------------------------------------------------
Department of Energy (DOE). DOE is responsible for protecting
electric power, oil, and natural gas delivery infrastructure and, in
December 2015, was identified in statute as the sector-specific agency
for cybersecurity for the energy sector.\49\ The Office of
Cybersecurity, Energy Security, and Emergency Response is the lead for
DOE's cybersecurity efforts.\50\ In addition, DOE operates the National
SCADA Test Bed Program, a partnership with Idaho National Laboratory,
Sandia National Laboratories, and other national laboratories which
addresses control system security challenges in the energy sector.
Among its key functions, the program performs control systems testing,
research, and development; control systems requirements development;
and industry outreach.
---------------------------------------------------------------------------
\49\ See Pub. L. No. 114-94, Sec. 61003(c)(2), 129 Stat. 1312, 1779
(2015).
\50\ DOE's Office of Cybersecurity, Energy Security and Emergency
Response cybersecurity program for energy delivery systems is
structured around three areas: (1) cybersecurity preparedness; (2)
cyber incident response and recovery; and (3) research, development,
and demonstration.
---------------------------------------------------------------------------
Federal Energy Regulatory Commission (FERC). FERC regulates the
U.S. bulk electric power system, which is increasingly powered by
natural gas pipeline systems.\51\ FERC has regulatory authority over
interstate natural gas pipelines under the Natural Gas Act.\52\
However, its role is limited to natural gas pipeline siting and rate
regulation. The North American Electric Reliability Corporation is the
federally designated U.S. Electric Reliability Organization, and is
overseen by FERC. The North American Electric Reliability Corporation,
with approval from FERC, has developed mandatory critical
infrastructure protection standards for protecting electric utility-
critical and cyber-critical assets.
---------------------------------------------------------------------------
\51\ FERC approved mandatory and enforceable cybersecurity
standards in 2008 and physical security standards in 2014 for U.S. bulk
electric operators. See 73 Fed. Reg. 7,368 (Feb. 7, 2008) (Order No.
706), 79 Fed. Reg. 70,069 (Nov. 25, 2014) (Order No. 802); see also 18
C.F.R. pt. 40.
\52\ See 42 U.S.C. Sec. 7172.
---------------------------------------------------------------------------
Private sector. Although TSA has primary Federal responsibility for
overseeing interstate pipeline security, private sector pipeline
operators are responsible for implementing asset-specific protective
security measures. As we previously reported, operators have increased
their attention on security by incorporating security practices and
programs into their overall business operations.\53\ Pipeline
operators' interests and concerns are primarily represented by five
major trade associations with ties to the pipeline industry--the
Interstate Natural Gas Association of America (INGAA), American Gas
Association (AGA), American Public Gas Association, American Petroleum
Institute (API), and Association of Oil Pipe Lines. According to TSA
officials, pipeline operators, and association representatives, these
associations have worked closely with the Federal government on a
variety of pipeline security-related issues, including collaborating on
TSA's voluntary standards and information sharing.
---------------------------------------------------------------------------
\53\ GAO-10-867.
---------------------------------------------------------------------------
Federal and Nonfederal Pipeline Stakeholders Exchange Risk-Related
Security Information
All of the pipeline operators and pipeline association
representatives we interviewed reported receiving security information
from Federal and nonfederal entities. Pipeline operators also reported
providing security-related information to Federal agencies, including
TSA, as incidents occur. Multiple Federal entities exchange alerts of
physical and cybersecurity incidents and other risk-related information
with critical infrastructure partners, including pipeline operators.
For example, DHS components including TSA's Intelligence and Analysis
and NCCIC share security-related information on physical and cyber
threats and incidents with sector stakeholders. Specifically,
Intelligence and Analysis provides quarterly intelligence briefings to
pipeline operators. NCCIC also issues indicator bulletins, which can
contain information related to cyber threat indicators, defensive
measures, and cybersecurity risks and incidents.
In addition, TSA and other Federal entities have coordinated to
address specific pipeline-related security incidents. For example, TSA
officials coordinated with DOT, DOE, the Department of Justice, and
FERC through the Oil and Natural Gas subsector SCC to address ongoing
incidents of vandalism and sabotage of critical pipeline assets by
environmental activists in 2016. In July 2017, according to DOT
officials, PHMSA and TSA collaborated on a web-based portal to
facilitate sharing sensitive but unclassified incident information
among Federal agencies with pipeline-related responsibilities. See
table 1 for the key Federal information sharing entities and programs
that exchange security-related or incident information with critical
infrastructure stakeholders, including the pipeline sector.
Table 1: Federal Information Sharing Entities and Programs that Provide
Information to Pipeline Stakeholders
------------------------------------------------------------------------
Entity/Program Product/service description
------------------------------------------------------------------------
Department of Homeland Security (DHS)
------------------------------------------------------------------------
National Cybersecurity NCCIC receives, triages, tracks, coordinates,
and Communications and manages high volumes of threat,
Integration Center vulnerability, and incident information on a
(NCCIC) 24/7 basis. The watch floor disseminates this
information to NCCIC analysts for resolution
and shares alerts, reports, and other
information products with the pipeline
community. NCCIC also facilitates weekly
teleconferences with private and public
entities to discuss situational awareness and
provide ongoing informational analysis related
to current events. In addition, its Cyber
Information Sharing and Collaboration Program
bulletins provide incident analysis
information derived from new cyber incidents
or malicious code, threats, and
vulnerabilities to, among others, pipeline
operators.a
------------------------------------------------------------------------
Transportation Security The TSOC is the conduit with which TSA
Administration (TSA) coordinates with DHS, the Federal Aviation
Transportation Security Administration, the Federal Bureau of
Operations Center Investigation, and other law enforcement and
(TSOC) security agencies to analyze and monitor
security-related operations, incidents and
crises in all transportation modes. In
addition, pipeline operators are asked to
voluntarily report security incidents to TSA
via the TSOC.
------------------------------------------------------------------------
TSA Intelligence and Intelligence and Analysis is to provide
Analysis pipeline industry security professionals with
timely and actionable information on terrorist
threats to hazardous liquid and natural gas
pipelines. For example, Intelligence and
Analysis is to prepare quarterly and annual
pipeline cyber and physical modal threat
assessments and unclassified quarterly threat
briefings based on analysis of primary threat
actors, credible terrorist plots, and
successful attacks, as well as tactics,
techniques, procedures, and targets that could
be employed in future attacks.
------------------------------------------------------------------------
National Terrorism NTAS Bulletins--NTAS, DHS's system for
Advisory System (NTAS) communicating terrorist threats to the
American public, issues bulletins that
communicate terrorism information alerting
sector stakeholders, including pipeline owners/
operators, of any elevated (i.e., general
information about timing and target) or
imminent (i.e., credible, specific, and
impending) threats.
------------------------------------------------------------------------
Homeland Security HSIN is the trusted network for homeland
Information Network security mission operations to share sensitive
(HSIN) but unclassified information. Federal, state,
local, territorial, tribal, international, and
private sector homeland security partners are
to use HSIN to manage operations, analyze
data, and send alerts and notices of cyber and
physical security threats.
------------------------------------------------------------------------
Protective Security PSAs are security subject matter experts who
Advisor (PSA) Program engage with state, local, tribal, and
territorial government mission partners and
members of the private sector stakeholder
community to protect the Nation's critical
infrastructure. PSAs are to conduct voluntary,
nonregulatory security surveys and assessments
on critical infrastructure assets and
facilities within their respective regions.
PSAs also may conduct outreach activities with
critical infrastructure owners and operators
in support of DHS's infrastructure protection
priorities.
------------------------------------------------------------------------
Department of Transportation (DOT)
------------------------------------------------------------------------
Pipeline and Hazardous PHMSA issues advisory bulletins to communicate
Materials Safety safety-related conditions to pipeline
Administration (PHMSA) operators and can issue advisory bulletins in
coordination with TSA to notify pipeline
operators of a security incident including
identifying the affected operators, describing
the threat, and providing information on
Federal resources for assistance. For example,
in response to physical intrusions of
pipelines and a coordinated campaign by
domestic saboteurs, PHMSA issued an advisory
bulletin, in coordination with TSA, to remind
pipeline operators of the importance of
safeguarding and securing their pipelines from
physical and cyber intrusion or attack
------------------------------------------------------------------------
Department of Energy (DOE)
------------------------------------------------------------------------
Cybersecurity Risk CRISP is a public-private partnership to
Information Sharing facilitate the timely sharing of cyber threat
Program (CRISP) information and develop situational awareness
tools to enhance the ability of the
electricity sector, including electric
companies or utilities that also own a natural
gas pipeline(s), to identify, prioritize, and
coordinate the protection of its critical
infrastructure. DOE shares actionable cyber
threat information with CRISP participants in
near-real time via the Electricity ISAC.
------------------------------------------------------------------------
Federal Energy Regulatory Commission (FERC)
------------------------------------------------------------------------
Office of Energy OEIS conducts joint voluntary assessments of
Infrastructure natural gas pipeline entities' information and
Security (OEIS) operational technology systems and networks to
assess their vulnerabilities to current
threats and emerging exploits. According to
FERC, under its Cybersecurity Architecture
Assessment program, OEIS and TSA take a
collaborative, nonregulatory approach to
promote secure and resilient infrastructure
through the sharing of information and best
practices. The goal of the assessment program
is to allow the assessed entity to gain a
comprehensive understanding of its overall
cybersecurity posture, identify potential
areas of concern, articulate actionable
recommendations and observations, and identify
best practices that promote improvements to
the security posture of the assessed entity.
------------------------------------------------------------------------
Source: GAO analysis of agency documents | GAO-19-48
a NCCIC sends Cyber Information Sharing and Collaboration Program
bulletins generally to local and state government, critical
infrastructure, private industry, or another country's computer
emergency response team.
Pipeline operators also share security-related information with TSA
and the NCCIC. In its Pipeline Security Guidelines, TSA requests that
pipeline operators report by telephone or e-mail to its Transportation
Security Operations Center (TSOC) any physical security incidents that
are indicative of a deliberate attempt to disrupt pipeline operations
or activities that could be considered precursors to such an
attempt.\54\ TSA's Pipeline Security Guidelines also request that
operators report any actual or suspected cyber attacks that could
impact pipeline industrial control systems or other information
technology-based systems to the NCCIC. According to the TSOC's
operating procedures, if a reported incident meets certain criteria,
such as the incident was intended to or resulted in damage or requires
a general evacuation of a facility, the TSOC watch officer is then to
contact Office of Security and Industry Engagement officials. According
to TSA officials, the TSOC does not conduct investigations of the
specific security incidents that pipeline operators report. However,
TSOC staff do analyze the incident information they receive for
national trends and common threats. TSA officials stated that they
share their observations with pipeline operators and other critical
infrastructure asset owners during monthly and quarterly conference
calls that TSA holds with pipeline operators.
---------------------------------------------------------------------------
\54\ According to TSA officials, freight and passenger rail are the
only two surface transportation modes whose operators are required to
report incidents, potential threats, or significant security concerns.
See 49 C.F.R. Sec. Sec. 1580.105, 1580.203.
---------------------------------------------------------------------------
All the pipeline operators and association representatives we
interviewed identified other nonfederal information sharing entities,
including ISACs, fusion centers, industry associations, and SCCs, which
provide forums for exchanging information about physical and cyber
incidents throughout the pipeline sector. See table 2 for nonfederal
information sharing entities identified as available to pipeline
operators.
Table 2: Nonfederal Information Sharing Entities
------------------------------------------------------------------------
Entity Product/service description
------------------------------------------------------------------------
Downstream Natural Gas The Downstream Natural Gas ISAC serves natural
Information Sharing gas utility (distribution) and pipeline
and Analysis Center (transmission) companies by facilitating
(ISAC) communications between participants, the
Federal government, and other critical
infrastructure. This ISAC is to disseminate
threat information and indicators from
government and other sources and provide
analysis, coordination, and summarization of
related industry-affecting information.
------------------------------------------------------------------------
Oil and Natural Gas The Oil and Natural Gas ISAC provides cyber
ISAC threat information for the oil and natural gas
industry. Its main goal is to assist in
increasing the security posture of the
industry's exploration and production,
transportation, refining, and delivery systems
from cyber-attacks through the analysis and
sharing of cyber intelligence. As an industry
owned and operated organization, it provides a
mechanism for members to share information
anonymously across its membership.
------------------------------------------------------------------------
Fusion centers Fusion centers are a collaborative effort of
two or more federal, state, local, or tribal
government agencies that combine resources,
expertise, or information with the goal of
maximizing the ability of such agencies to
detect, prevent, investigate, apprehend, and
respond to criminal or terrorist activity. For
example, according to TSA officials, the New
York State Intelligence Center shares threat
data with pipeline operators.
------------------------------------------------------------------------
Industry associations Industry associations, such as the American Gas
Association, the American Petroleum Institute,
and the Interstate Natural Gas Association of
America, representing companies delivering
natural gas, exchange security-related
information. Examples of such activities can
include disseminating alerts from the National
Cybersecurity and Communications Integration
Center to their membership, hosting events to
promote security awareness, and sharing
security-related resources and guidance.
------------------------------------------------------------------------
InfraGard InfraGard, a partnership between the Federal
Bureau of Investigation and the private
sector, is to provide a vehicle for the timely
exchange of information and promotes learning
opportunities relevant to the protection of
the Nation's critical infrastructure.
------------------------------------------------------------------------
Oil and Natural Gas The Oil and Natural Gas SCC is to provide a
Subsector Coordinating private forum for coordination of oil and
Council (SCC) natural gas security strategies and
activities, policy, and communication across
the sector to support the Nation's homeland
security mission. This SCC provides a venue
for industry owners and operators to mutually
plan, implement, and execute sufficient and
appropriate sector-wide security programs,
procedures and processes, exchange
information, and assess accomplishments and
progress toward continuous improvement in the
protection of the sector's critical
infrastructure.
------------------------------------------------------------------------
Source: GAO analysis of agency documents | GAO-19-48
Operators and TSA officials reported that the current backlog in
granting security clearances for some key pipeline operator employees
was a significant factor affecting information sharing between TSA and
pipeline operators. TSA officials acknowledged that some pipeline
operators have had difficulty obtaining security clearances for key
employees due to ongoing backlogs in processing requests by the Office
of Personnel Management National Background Investigation Bureau, and
that TSA's ability to share timely information with operators whose
staff do not have a clearance may be hindered. Three of the 10 pipeline
operators we interviewed identified receiving timely classified
security information as a specific challenge due, in part, to
difficulties staff have had obtaining security clearances. Further, 7
of the 10 pipeline operators that we interviewed reported experiencing
delays in obtaining a security clearance or were aware of others who
had experienced this issue. However, according to three operators we
interviewed, TSA was helpful in facilitating approval of security
clearances for the operators' personnel to access classified
information when necessary.
This security clearance challenge is not faced by pipeline
operators alone. In January 2018, we designated the backlog of
investigations for the clearance process and the government-wide
personnel security clearance process as a high-risk area. We will
continue to monitor agencies' progress in reducing the backlog and
improving the security clearance process.\55\
---------------------------------------------------------------------------
\55\ See GAO press release ``GAO Adds Government-wide Personnel
Security Clearance Process to `High Risk List' '' (Washington, D.C.,
Jan. 25, 2018).
---------------------------------------------------------------------------
Pipeline Operators Use a Range of Guidelines and Standards to Address
Risks, but TSA's Guidelines Lack Clear Definitions and a
Process for Updating Them
Pipeline operators that we interviewed reported using a range of
guidelines and standards to address their physical and cybersecurity
risks, and all of them reported implementing TSA's voluntary Pipeline
Security Guidelines that were applicable to their operations. TSA
revised and issued its Pipeline Security Guidelines in March 2018, but
the revised guidelines lack a defined process to consider updates to
supporting guidance such as to the NIST Framework for Improving
Critical Infrastructure Cybersecurity (Cybersecurity Framework).
Furthermore, TSA has not clearly defined the terms within the criteria
that pipeline operators are to use to determine the criticality of
their facilities.
Pipeline Operators Use a Range of Guidelines and Standards to Address
Security
Pipeline operators that we interviewed reported using a range of
guidelines and standards to address their physical and cybersecurity
risks. For example, all 10 of the pipeline operators we interviewed
stated they had implemented the voluntary 2011 TSA Pipeline Security
Guidelines the operators determined to be applicable to their
operations.\56\ The guidelines provide TSA's recommendations for
pipeline industry security practices such as establishing a corporate
security program and identifying critical facilities among others (see
sidebar).\57\ Five of the 10 pipeline operators we interviewed
characterized the guidelines as generally or somewhat effective in
helping to secure their operations, 1 was neutral on their
effectiveness, and 4 did not provide an assessment of the guidelines'
effectiveness. However, one operator pointed out that they had not
adopted the guidelines' recommended interval of 36 months or less for
conducting security vulnerability assessments due to staffing
limitations.\58\ Also, another pipeline operator noted that they were
working to implement the guidelines in the operations of a newly
acquired asset that they determined was not using the guidelines in the
same manner as their company.
---------------------------------------------------------------------------
\56\ Transportation Security Administration, Pipeline Security
Guidelines (April 2011). TSA did not issue the revised guidelines until
March 2018.
\57\ According to industry association officials, AGA and INGAA
members have made voluntary commitments to implement TSA's Pipeline
Security Guidelines.
\58\ TSA's Pipeline Security Guidelines call for pipeline operators
of critical facilities to conduct a security vulnerability assessment
or the equivalent on a periodic basis, not to exceed 36 months, and
within 12 months after completion of a significant enhancement or
modification to the facility.
---------------------------------------------------------------------------
All of the pipeline operators we interviewed reported using other
guidelines or standards to address pipeline systems' security risks.
For example, pipeline operators reported using and industry association
representatives reported that their members use INGAA's Control Systems
Cyber Security Guidelines for the Natural Gas Pipeline Industry,\59\
API's Pipeline SCADA Security standard,\60\ and the NIST Cybersecurity
Framework as sources of cybersecurity standards, guidelines, and
practices that may be scaled and applied to address a pipeline
operator's cybersecurity risks.\61\
---------------------------------------------------------------------------
\59\ Interstate Natural Gas Association of America, Control Systems
Cyber Security Guidelines for the Natural Gas Pipeline Industry Version
1.3 (Washington, D.C.: September 17, 2015).
\60\ American Petroleum Institute, Pipeline SCADA Security, API
Standard 1164 (June 2009).
\61\ NIST, Framework for Improving Critical Infrastructure
Cybersecurity, Version 1.0 (Feb. 12, 2014). In response to Executive
Order 13636, NIST issued the Framework for Critical Infrastructure
Cybersecurity, which is intended to help organizations apply the
principles and best practices of risk management to improving the
security and resilience of critical infrastructure. The framework
consists of five concurrent and continuous functions--identify,
protect, detect, respond, and recover. When considered together, these
functions provide a high-level, strategic view of the life-cycle of an
organization's management of cybersecurity risk.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Further, pipeline operators are required to adhere to regulations
related to pipeline safety and, depending upon their assets,
operations, and location, may be required to adhere to regulations for
electrical utilities, chemical storage facilities, and locations near
waterways. For example, all pipeline operators must adhere to DOT's
PHMSA safety regulations.\62\ In addition, pipeline operators whose
systems include chemical facilities may be required to comply with
DHS's Chemical Facility Anti-Terrorism Standards (CFATS).\63\ Pipeline
operators whose systems include a terminal located on a U.S. port may
be required to comply with Maritime Transportation Security Act
regulations.\64\ For a listing of Federal and industry guidelines
identified as applicable to security by the pipeline operators, see
appendix I.
---------------------------------------------------------------------------
\62\ See 49 C.F.R. pts. 190-199.
\63\ See 6 C.F.R. pt. 27. In 2007, DHS established the CFATS
program to assess the risk posed by chemical facilities, place High
Risk facilities in one of four risk-based tiers, require High Risk
facilities to develop security plans, review these plans, and inspect
the facilities to ensure compliance with regulatory requirements.
\64\ Maritime Transportation Security Act of 2002, enacted to
protect the Nation's ports and waterways from a terrorist attack,
regulates operators, including pipeline operators, with off shore or
port facilities and requires certain protective measures such as
vulnerability assessments and security plans. See generally Pub. L. No.
107-295, 116 Stat. 2064.
---------------------------------------------------------------------------
TSA Does Not Have a Documented Process for Updating Its Pipeline
Security Guidelines to Reflect Revisions to Supporting
Standards
TSA's Pipeline Security Branch issued its revised Pipeline Security
Guidelines in March 2018, but TSA has not established a documented
process to ensure that revisions occur and fully capture updates to
supporting standards and guidance. The guidelines were revised to,
among other things, reflect the dynamic threat environment and to
incorporate cybersecurity principles and practices from the NIST
Cybersecurity Framework, which were initially issued in February 2014.
To revise the guidelines and incorporate feedback, according to
Pipeline Security Branch officials, they incorporated outcomes from
pipeline modal threat assessments and best practices from security
reviews, and collaborated with pipeline sector stakeholders--including
industry associations and other Federal agencies with a role in
pipeline security.
Officials from the industry associations we interviewed confirmed
that they provided input to the revised pipeline guidelines, including
meeting with and consolidating comments from member pipeline operators.
See figure 6 for a timeline of events pertinent to Federal pipeline
security guidelines.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
TSA's Pipeline Security Smart Practice Observations for pipeline
operators states that security plans should have a documented process
to include security plan reviews and updates on a periodic and an as-
needed basis.\65\ Standards for Internal Control in the Federal
Government states that periodic review of policies, procedures, and
related control activities should occur to determine their continued
relevance and effectiveness in achieving identified objectives or
addressing related risks.\66\ The NIPP and NIST also emphasize the need
to provide updates on incident response guidance and security
procedures, respectively. Moreover, other pipeline industry guidance
cited by TSA's guidelines also has a prescribed interval for review and
revision. For example, API reviews its standards at least every 5
years.
---------------------------------------------------------------------------
\65\ Transportation Security Administration, Pipeline Security
Smart Practice Observations (September 19, 2011).
\66\ GAO-14-704G.
---------------------------------------------------------------------------
However, TSA has not instituted a documented process to consider
the need to update the Pipeline Security Guidelines on a regular basis.
Pipeline Security Branch officials acknowledged the value of having a
defined process for reviewing and, if necessary, revising TSA's
Pipeline Security Guidelines at regular defined intervals to ensure it
includes, among other things, newly identified best practices and
updated industry guidance that are relevant to pipeline operators, such
as the elements of the latest version of NIST's Cybersecurity
Framework. For example, TSA's revisions to its guidelines incorporated
some, but not all of the elements of the NIST Cybersecurity Framework
version 1. Specifically, to improve incident response, the NIST
framework recommends implementing an incident response analysis and
feedback function to a security program. However, TSA's Pipeline
Security Guidelines do not include similar steps for pipelines
operators to include in their pipeline security programs. Further,
because NIST released version 1.1 of the Cybersecurity Framework in
April 2018, the guidelines that TSA released in March 2018 do not
incorporate cybersecurity elements that NIST added to the latest
Cybersecurity Framework such as the Supply Chain Risk Management
category.\67\
---------------------------------------------------------------------------
\67\ NIST Special Publication 800-161, Supply Chain Risk Management
Practices for Federal Information Systems and Organizations (April
2015). Supply chains begin with the sourcing of products and services
and extend from the design, development, manufacturing, processing,
handling, and delivery of products and services to the end user. Cyber
supply chain risk management entails identifying, assessing, and
mitigating ``products and services that may contain potentially
malicious functionality, are counterfeit, or are vulnerable due to poor
manufacturing and development practices within the cyber supply
chain.''
---------------------------------------------------------------------------
Pipeline Security Branch officials said that they have not
instituted a review process on a regular basis because they intended to
review and revise TSA's guidelines on an as-needed basis in response to
updated supporting guidance, but could provide no timeline for doing
so. Without a documented process defining how frequently Pipeline
Security Branch staff are to review and revise its guidelines, TSA
cannot ensure that its guidelines reflect the latest known standards
and best practices for physical and cybersecurity, or address the
persistent and dynamic security threat environment currently facing the
Nation's pipeline system.
Pipeline Security Guidelines Lack Clear Definitions to Ensure Pipeline
Operators Consistently Apply TSA's Criteria for Identifying
Critical Facilities
Under TSA's Pipeline Security Guidelines, pipeline operators are to
self-identify the critical facilities within their system and report
their critical facilities to TSA. TSA's Pipeline Security Branch
conducts CFSRs at the critical facilities that pipeline operators have
identified.
However, our analysis of TSA's data found that at least 34 of the
top 100 critical pipeline systems deemed highest risk indicated that
they had no critical facilities.\68\ Accordingly, TSA would not conduct
a CFSR at any of these systems' facilities because their operators
identified none of them as critical.
---------------------------------------------------------------------------
\68\ Data on critical facility count for 10 of the 100 most
critical pipeline systems were not present in the ranking.
---------------------------------------------------------------------------
The fact that pipeline operators of about one third of the highest
risk systems identified no critical facilities may be due, in part, to
the Pipeline Security Branch not clearly defining the criteria outlined
in the Pipeline Security Guidelines that pipeline operators are to use
to determine the criticality of their facilities. Three of the 10
operators we interviewed stated that some companies reported to TSA
that they had no critical facilities, and may possibly be taking
advantage of the guidelines' lack of clarity. Accordingly, operators
that report no critical facilities would avoid TSA's reviews of their
facilities.
Our review of the eight criteria included in TSA's Pipeline
Security Guidelines (see sidebar) found that no additional examples or
clarification are provided to help operators determine criticality.
Although we previously noted that 5 of the 10 operators we interviewed
generally found TSA's Guidelines as a whole helpful in addressing
pipeline security, more than half of the operators we interviewed
identified TSA's criticality criteria as a specific area for
improvement. Specifically, 3 of the 10 pipeline operators that we
interviewed stated that TSA had not clearly defined certain terms
within the criteria, and 3 additional operators of the 10 reported that
additional consultation with TSA was necessary to appropriately apply
the criteria and determine their facilities' criticality. For example,
2 operators told us that individual operators may interpret TSA's
criterion, ``cause mass casualties or significant health effect,''
differently.
One of these operators that we interviewed stated that this
criterion could be interpreted either as a specific number of people
affected or a sufficient volume to overwhelm a local health department,
which could vary depending on the locality. Another operator reported
that because TSA's criteria were not clear, they created their own
criteria which helped the operator identify two additional critical
facilities.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Pipeline Security Branch officials acknowledged there are companies
that report having no critical facilities in their pipeline systems.
According to Pipeline Security Branch officials, pipeline operators are
in the best position to determine which of their facilities are
critical, and the companies that have determined that their pipeline
systems have no critical facilities also have reported sufficient
redundancies to make none of their facilities critical to the
continuity of their operations. According to these officials, they have
had extensive discussions with pipeline company officials to assess the
validity of their criticality determinations, and have closely
questioned companies to ensure they have properly applied TSA's
criteria.
However, according to TSA's Pipeline Security Guidelines, operators
should use a consistent set of criteria for determining the criticality
of their facilities. In addition, Standards for Internal Control in the
Federal Government states that management should define objectives
clearly to enable the identification of risks.\69\ To achieve this,
management generally defines objectives in specific and measurable
terms and ensures the terms are fully and clearly set forth so they can
be easily understood.
---------------------------------------------------------------------------
\69\ GAO, Standards for Internal Control in the Federal Government,
GAO-14-704G (Washington, D.C.: Sept. 10, 2014)
---------------------------------------------------------------------------
Pipeline Security Branch officials acknowledged that the
criticality definitions in the Pipeline Security Guidelines could be
clarified to be more specific. Additionally, an industry association
representative reported that the association, in consultation with TSA,
has been developing supplementary guidance for its members to clarify
certain terms in TSA's critical facility criteria. As of October 2018
this guidance is still under review at the association and has not been
made available to the association's members. Pipeline Security Branch
officials confirmed they worked with the industry association on its
supplementary guidance, but also acknowledged that the supplementary
guidance may only be distributed to the association's membership.
Without clearly defined criteria for determining pipeline
facilities' criticality, TSA cannot ensure that pipeline operators are
applying its guidance uniformly. Further, because TSA selects the
pipeline facilities on which to conduct CFSRs based on operators'
determinations, TSA cannot fully ensure that all of the critical
facilities across the pipeline sector have been identified using the
same criteria, or that their vulnerabilities have been identified and
addressed.
TSA Assesses Pipeline Risk and Conducts Security Reviews, but Limited
Workforce Planning and Shortfalls in Assessing Risk Present
Challenges
TSA's Intelligence and Analysis identifies security risks to
pipeline systems through various assessments. Additionally, TSA's
Pipeline Security Branch conducts security reviews to assess pipeline
operators' implementation of TSA's Pipeline Security Guidelines, but
gaps in staffing and lack of a workforce plan may affect its ability to
carry out effective reviews. The Pipeline Security Branch also
developed a pipeline risk assessment to rank relative risk of the top
100 critical pipeline systems and to prioritize its security reviews of
pipeline companies, but shortfalls in its calculations of threat,
vulnerability, and consequence may limit its ability to accurately
identify pipeline systems with the highest risk. Finally, the pipeline
risk assessment has not been peer reviewed to validate the assessment's
data and methodology, which we previously reported as a best practice
in risk management.
TSA Conducts Assessments of Pipeline Security Risks
TSA's Intelligence and Analysis produces assessments related to
pipeline security risks, including Pipeline Modal and Cyber Modal
Threat Assessments and the Transportation Sector Security Risk
Assessment. The Pipeline and Cyber Modal Threat Assessments are issued
on a semiannual basis; TSA Intelligence and Analysis may also issue
additional situation-based products on emerging threats. The Pipeline
Modal and Cyber Modal Threat Assessments evaluate, respectively,
physical and cyber threats to pipelines. The pipeline modal threat
assessment evaluates terrorist threats to hazardous liquid and natural
gas pipelines, and the cyber modal threat assessment evaluates cyber
threats to transportation, including pipelines. Both assessments
specifically analyze the primary threat actors, their capabilities, and
activities--including attacks occurring internationally--as well as
other characteristics of threat.
The Transportation Sector Security Risk Assessment assesses threat,
vulnerability, and consequence for various attack scenarios across the
five transportation modes for which TSA is responsible.\70\ The
scenarios define a type of threat actor--including homegrown violent
extremists and transnational extremists, such as al Qaeda and its
affiliates--a target, and an attack mode. For example, a scenario might
assess the risk of attacks using varying sizes of improvised explosive
devices on pipeline system assets. As part of the assessment process,
TSA engages with subject matter experts from TSA and industry
stakeholder representatives to compile vulnerabilities for each mode,
and TSA analyzes both direct and indirect consequences of the various
attack scenarios. According to Pipeline Security Branch officials, the
assessments produced by TSA's Intelligence and Analysis provide key
information to inform the pipeline security program's efforts.
---------------------------------------------------------------------------
\70\ According to TSA, the Transportation Sector Security Risk
Assessment was developed both in response to requirements in statute to
conduct risk assessments for the Transportation Systems sector and to
fulfill TSA's operational and strategic need for a comprehensive risk
assessment to aid in planning, risk-based decision making, and resource
allocation. See, e.g., Pub. L. No. 110-53, Sec. 1511, 121 Stat. 426-29
(2007); 6 U.S.C. Sec. 1161 (requiring the submission of a nationwide
risk assessment of a terrorist attack on railroad carriers). The five
transportation modes for which TSA is responsible are: Aviation;
Freight Rail; Highway; Pipeline; and Mass Transit.
---------------------------------------------------------------------------
TSA Conducts Pipeline Security Reviews to Assess Implementation of
Pipeline Guidelines, but Does Not Have a Strategic Workforce
Plan to Address Staffing Challenges
According to TSA officials, TSA conducts pipeline security
reviews--Corporate Security Reviews (CSRs) and Critical Facility
Security Reviews (CFSRs)--to assess pipeline vulnerabilities and
industry implementation of TSA's Pipeline Security Guidelines. However,
as shown by Figure 7 below, the number of CSRs and CFSRs completed by
TSA has varied during the last five Fiscal Years, ranging from zero
CSRs conducted in Fiscal Year 2014 to 23 CSRs conducted in Fiscal Year
2018, as of July 31, 2018.\71\
---------------------------------------------------------------------------
\71\ According to TSA officials, the decline in CSRs from 2013 to
2015 was caused by travel restrictions during sequestration, as well a
reorganization which moved the assessment function.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
a Fiscal year (FY) 2018 data are through July 31, 2018.
b Fiscal years 2010 and 2011 represent Critical Facility
Inspections, which were the predecessor to CFSRs.
TSA officials reported that staffing limitations have prevented TSA
from conducting more reviews. As shown in table 3, TSA Pipeline
Security Branch staffing levels (excluding contractor support) have
varied significantly over the past 9 years ranging from 14 full-time
equivalents (FTEs) in Fiscal Years 2012 and 2013 to one FTE in Fiscal
Year 2014. They stated that, while contractor support has assisted with
conducting CFSRs, there were no contractor personnel providing CSR
support from Fiscal Years 2010 through 2017, but that has now increased
to two personnel in Fiscal Year 2018.\72\
---------------------------------------------------------------------------
\72\ In addition to TSA pipeline personnel, pipeline security
reviews received support from contractors and other personnel within
TSA's Surface Division. TSA awards for contract support amounted to
$2,443,634 on Critical Facility Inspections from Fiscal Years 2008 to
2011, $3,978,151 on CFSRs from Fiscal Years 2012 to 2016, $2,233,928 on
CFSRs from Fiscal Years 2017 to 2021, and $2,366,481 on CSRs from
Fiscal Years 2017 to 2021.
Table 3: TSA Pipeline Security Branch Staffing Levels, Fiscal Years 2010 through 2018
----------------------------------------------------------------------------------------------------------------
Fiscal Year TSA Pipeline Security Branch Staffinga
----------------------------------------------------------------------------------------------------------------
2010 13
----------------------------------------------------------------------------------------------------------------
2011 13
----------------------------------------------------------------------------------------------------------------
2012 14
----------------------------------------------------------------------------------------------------------------
2013 14
----------------------------------------------------------------------------------------------------------------
2014 1
----------------------------------------------------------------------------------------------------------------
2015 6
----------------------------------------------------------------------------------------------------------------
2016 6
----------------------------------------------------------------------------------------------------------------
2017 6
----------------------------------------------------------------------------------------------------------------
2018 6
----------------------------------------------------------------------------------------------------------------
Source: Transportation Security Administration (TSA) documents. | GAO-19-48
a TSA pipeline staffing numbers are in full-time equivalents.
TSA prioritizes reviewing and collecting information on the
Nation's top 100 critical pipeline systems. According to TSA officials,
they would need to conduct 46 CSRs in order to review the top 100
critical pipeline systems. In July 2018, TSA officials stated that
TSA's current target was to assess each pipeline company every 2 to 3
years; this would equate to about 15 to 23 CSRs per year.\73\ TSA
officials stated that they expect to complete 20 CSRs and 60 CFSRs per
Fiscal Year with Pipeline Security Branch employees and contract
support, and have completed 23 CSRs through July 2018 for Fiscal Year
2018.
---------------------------------------------------------------------------
\73\ To calculate the number of annual CSRs it would take to meet
TSA's current target, we divided 46 CSRs by the number of years stated.
For example, 46 CSRs divided by 2 years equals 23 CSRs per year; 46
CSRs divided by 3 years equals approximately 15 CSRs per year. This
assumes that TSA does not review a pipeline company more than once in
that time frame.
---------------------------------------------------------------------------
Given the ever-increasing cybersecurity risks to pipeline systems,
ensuring that the Pipeline Security Branch has the required
cybersecurity skills to effectively evaluate pipeline systems'
cybersecurity is essential. Pipeline operators we interviewed
emphasized the importance of cybersecurity skills among TSA staff.
Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry
representatives we interviewed reported that the level of cybersecurity
expertise among TSA staff and contractors may challenge the Pipeline
Security Branch's ability to fully assess the cybersecurity portions of
its security reviews. TSA officials stated that Security Policy and
Industry Engagement staff are working with DHS's National Protection
and Programs Directorate to help address cyber-related needs, including
identifying specific cybersecurity skills and competencies required for
the pipeline security program. The officials were uncertain, however,
whether TSA would use contractor support or support from the National
Protection and Programs Directorate to provide identified skills and
competencies. TSA officials also stated that Security Policy and
Industry Engagement staff work with TSA's human resource professionals
to identify critical skills and competencies needed for Pipeline
Security Branch personnel, and helps its workforce maintain
professional expertise by providing training and education for any
identified skill or competency gaps.
Our previous work has identified principles that a strategic
workforce planning process should follow including developing
strategies tailored to address gaps in number, deployment, and
alignment of human capital approaches for enabling and sustaining the
contributions of all critical skills and competencies.\74\ Workforce
planning efforts, linked to an agency's strategic goals and objectives,
can enable it to remain aware of and be prepared for its needs,
including the size of its workforce, its deployment across the
organization, and the knowledge, skills, and abilities needed for it to
pursue its mission. Agencies should consider how hiring, training,
staff development, performance management, and other human capital
strategies can be aligned to eliminate gaps and improve the long-term
contribution of skills and competencies identified as important for
mission success.\75\
---------------------------------------------------------------------------
\74\ GAO, Human Capital: Key Principles for Effective Strategic
Workforce Planning, GAO-04-39 (Washington, D.C.: Dec. 11, 2003).
\75\ GAO, Human Capital: A Guide for Assessing Strategic
Development Efforts in the Federal Government, GAO-04-546G (Washington,
D.C.: Mar. 1, 2004).
---------------------------------------------------------------------------
TSA has not established a workforce plan for its Security Policy
and Industry Engagement or its Pipeline Security Branch that identifies
staffing needs and skill sets such as the required level of
cybersecurity expertise among TSA staff and contractors. When asked for
TSA strategic workforce planning documents used to inform staffing
allocations related to the pipeline security program, TSA officials
acknowledged they do not have a strategic workforce plan. Rather,
according to these officials, TSA determines agency-level staffing
allocations through the Planning, Programming, Budgeting and Execution
process, which is used to decide policy, strategy, and the development
of personnel and capabilities to accomplish anticipated missions.
According to TSA officials, when they use this process they look at
existing resources and then set priorities based on the TSA
Administrator's needs. However, a strategic workforce plan allows an
agency to identify and prepare for its needs, such as the size of its
workforce, its deployment across the organization, and the knowledge,
skills, and abilities needed to pursue its mission. TSA officials
stated that the agency has a detailed allocation plan for strategically
aligning resources to screen passengers at TSA-regulated airports, but
not for the entire agency.\76\
---------------------------------------------------------------------------
\76\ In 2018, we reported on TSA's airport staffing model and its
use in assigning screening personnel to airports. See GAO, Aviation
Security: TSA Uses Current Assumptions and Airport-Specific Data for
Its Staffing Process and Monitors Passenger Wait Times Using Daily
Operations Data, GAO-18-236 (Washington, D.C.: Feb. 1, 2018).
---------------------------------------------------------------------------
By establishing a strategic workforce plan, TSA can help ensure it
has identified the knowledge, skills, and abilities that the future
workforce of TSA's Pipeline Security Branch may need in order to meet
its mission of reducing pipeline systems' vulnerabilities to physical
and cybersecurity risks, especially in a dynamic and evolving threat
environment. Further, as greater emphasis is placed on cybersecurity,
determining the long-term staffing needs of the Pipeline Security
Branch will be essential. Furthermore, a workforce plan could enable
TSA to determine the number of personnel it needs to meet its stated
goals for conducting CSRs and CFSRs.
TSA Calculates Relative Risk of Pipeline Systems, but Its Ranking Tool
Does Not Include Current Data or Align with DHS Priorities to
Help Prioritize Security Reviews
After TSA identifies the top 100 critical pipeline systems based on
throughput, the Pipeline Security Branch uses the Pipeline Relative
Risk Ranking Tool (risk assessment), which it developed in 2007, to
assess various security risks of those systems.\77\ We previously
reported, in 2010, that the Pipeline Security Branch was the first of
TSA's surface transportation modes to develop a risk assessment model
that combined all three components of risk--threat, vulnerability, and
consequence--to generate a risk score.\78\ The risk assessment
generates a risk score for each of the 100 most critical pipeline
systems and ranks them according to risk. The risk assessment
calculates threat, vulnerability, and consequence for each pipeline
system on variables such as the amount of throughput in the pipeline
system and the number critical facilities. The risk assessment combines
data collected from pipeline operators, as well as other Federal
agencies, such as the Departments of Transportation and Defense, to
generate the risk score.
---------------------------------------------------------------------------
\77\ According to DHS, a risk assessment is a product or process
which collects information and assigns values to risks for the purpose
of informing priorities, developing or comparing courses of action, and
informing decision-making. A risk assessment is also considered the
appraisal of the risks facing an entity, asset, system, network,
geographic area or other grouping. See DHS Risk Lexicon, 2010.
\78\ See GAO-10-867.
---------------------------------------------------------------------------
However, the last time the Pipeline Security Branch calculated
relative risk among the top 100 critical pipeline systems using the
risk assessment was in 2014. Pipeline Security Branch officials told us
that they use the pipeline risk assessment to rank relative risk of the
top 100 critical pipeline systems, and the standard operating
procedures for conducting CSRs state the results of the risk ranking
are the primary factor considered when prioritizing corporate security
reviews of pipeline companies.\79\ According to Pipeline Security
Branch officials, the risk assessment has not changed since 2014
because the Pipeline Security Branch is still conducting CSRs based on
the 2014 ranking of pipeline systems.
---------------------------------------------------------------------------
\79\ In August 2010, we recommended, among other things, that the
Pipeline Security Branch document a methodology for scheduling CSRs
that considers a pipeline system's risk ranking as the primary
scheduling criteria and to balance that with other practical
considerations. As a result, the Pipeline Security Branch revised its
CSR Standard Operating Procedures, as documented in a copy dated May
20, 2011, to state that the primary criteria for scheduling CSR visits
is the pipeline system's relative risk (i.e., risk ranking), although
other factors and considerations, such as operator availability and
geographic location, will also play a role. Version 4.4, dated April
24, 2012, includes the same language. See GAO-10-867.
---------------------------------------------------------------------------
As outlined in table 4 below, we identified several factors that
likely limit the usefulness of the current risk assessment in
calculating threat, vulnerability, and consequence to allow the
Pipeline Security Branch to effectively prioritize reviews of pipeline
systems. For example, because the risk assessment has not changed since
2014, information on threat may be outdated. Additionally, sources of
data and underlying assumption and judgments regarding certain threat
and vulnerability inputs to the assessment are not fully documented.
For example, threats to cybersecurity are not specifically accounted
for in the description of the risk assessment methodology, making it
unclear if cybersecurity is part of the assessment's threat factor.
Further, the risk assessment does not include information that is
consistent with the NIPP and other DHS priorities for critical
infrastructure risk mitigation, such as information on natural hazards
and the ability to measure risk reduction (feedback data).
According to Pipeline Security Branch officials, the risk ranking
assessment is not intended to be a fully developed risk model detailing
all pipeline factors influencing risk. Rather, officials said they are
primarily interested in assessing risk data that impacts security.
However, because TSA's Pipeline Security Program is designed to enhance
the security preparedness of the pipeline systems, incorporating
additional factors that enhance security into their risk calculation
would better align their efforts with PPD-21. For example, PPD-21 calls
for agencies to integrate and analyze information to prioritize assets
and manage risks to critical infrastructure, as well as anticipate
interdependencies and cascading impacts. For a more detailed discussion
of the shortfalls we identified, refer to appendix II.
Table 4: Shortfalls in the Pipeline Security Branch's Risk Ranking Assessment
----------------------------------------------------------------------------------------------------------------
Shortfall Description and
Corresponding Risk Element
Identified Shortfalls in the Affected: Threat (T), Why It Matters
Risk Assessment Vulnerability (V), Consequence
(C)
----------------------------------------------------------------------------------------------------------------
Information may be outdated The Pipeline Security T Standards for Internal
Branch has not updated the Control in the Federal
risk assessment since June Government calls for management
2014, because of competing to use quality information to
priorities. Therefore, achieve the entity's
information used to determine objectives, including using
calculations, such as threat relevant data from reliable
information, may be outdated sources obtained in a timely
and not reflect threats to manner.
the industry that have Keeping the risk
emerged in recent years. assessment updated with current
information could help the
Pipeline Security Branch ensure
it is using its limited
resources to review the
pipeline systems with greater
risk.
When the risk C
assessment was last updated
in 2014, it used pipeline
systems' throughput data from
2010 to assess relative risk
and throughput may have
changed since 2010.
Data sources, underlying The Pipeline Security T According to the
assumptions and judgments, and Branch ranked threat equally National Infrastructure
sources of uncertainty not across pipeline systems Protection Plan (NIPP), a risk
always documented because officials say they do assessment's methodology must
not have enough threat clearly document what
information to distinguish information is used and how it
threat by pipeline. However, is synthesized to generate a
this judgment is not risk estimate, including any
documented in the risk assumptions, judgments, sources
assessment's methodology. of uncertainty, and any
implications for interpreting
the results from the
assessment.
Threats to T
cybersecurity are not
specifically accounted for in
the description of the risk
assessment methodology.
The number of V Documenting sources of
critical facilities is part data and agency assumptions,
of a pipeline system's judgments, or decisions to
vulnerability score, but exclude information could
pipeline operators do not provide increased transparency
identify critical facilities to those expected to interpret
consistently, leading to or use the results.
uncertainty in this input.
----------------------------------------------------------------------------------------------------------------
Does not include risk information
consistent with the NIPP or
other Department of Homeland
Security (DHS) priorities for
critical infrastructure risk
mitigation, such as:
data on prior attacks The pipeline risk T Information provided by
assessment includes a field the Pipeline Security Branch
that accounts for whether a suggests some pipeline systems
pipeline experienced a have experienced such threats.
previous security threat According to the NIPP,
(including failed attacks). judgments, such as deciding not
However, that field is not to include information, should
used in the risk assessment's be articulated in the
calculation. Pipeline methodology.
Security Branch officials Including past attacks
acknowledged that prior on pipeline systems could help
attacks should be part of the the Pipeline Security Branch
threat calculation, but could better differentiate threat
not account for why they were among pipeline systems.
not calculated for the
systems in the risk
assessment.
----------------------------------------------------------------------------------------------------------------
natural hazards The pipeline risk T According to the NIPP,
assessment does not account threat includes natural hazards
for natural hazards in its with the potential to harm
threat calculation. According life, information, operations,
to Pipeline Security Branch the environment, and/or
officials, there is not property. As such, natural
sufficient historical data disasters are a key element of
available that would indicate the DHS's critical
a significant impact from infrastructure security and
natural disasters on pipeline resilience mission.
infrastructure. However, we While there may not be
identified possible sources historical data of natural
of data for the Pipeline hazard impact for every
Security Branch to consider, pipeline system, consulting
including information from other sources or experts could
the Federal Emergency provide data or analysis for a
Management Agency. more comprehensive threat
picture.
----------------------------------------------------------------------------------------------------------------
feedback data on pipeline system The risk assessment V The NIPP and DHS's Risk
performance, including is unable to measure the Management fundamentals
cybersecurity progress a pipeline system emphasize the important role
made in addressing that a feedback mechanism plays
vulnerability gaps between in risk management.
reviews, because Pipeline As pipeline operators
Security Branch officials implement increasing levels of
said their current measure--a network technologies to control
vulnerability score--is their systems, the Pipeline
unreliable for comparative Security Branch may not be
and analytic purposes. fully accounting for pipeline
However, they agree on the systems' cybersecurity
importance of a feedback activities by not including the
mechanism tying results of cybersecurity-related
reviews to a revised vulnerabilities in its risk
vulnerability metric. assessment inputs. Developing a
feedback mechanism based on
implementation of TSA's
Pipeline Security Guidelines-
including those on
cybersecurity-could be an
important input to the risk
assessment's vulnerability
calculation. This information
would also inform the amount of
risk pipeline companies are
reducing by implementing the
guidelines and could be used to
inform overall risk reduction.
The risk assessment V
does not include a measure of
cybersecurity
vulnerabilities. According to
Pipeline Security Branch
officials, absent data
specific to pipelines on
their cyber vulnerabilities,
they are unable to include a
pipeline's vulnerability to
cyber attack in the risk
assessment.
----------------------------------------------------------------------------------------------------------------
physical pipeline condition Pipeline physical V DHS has listed the
condition is not accounted potential for catastrophic
for in the current risk losses to dramatically increase
assessment. However, pipeline the overall risk associated
condition or location (such with failing infrastructure and
as above or below ground) highlighted risks due to
could touch upon pipeline climate change and natural
security as it relates to hazards to pipelines. The NIPP
system vulnerability. defines vulnerability as a
According to the physical feature or operational
Transportation Systems Sector- attribute that renders an
Specific Plan, entity open to exploitation or
vulnerabilities to damage in susceptible to a given threat
aging transportation or hazard.
infrastructure--of which By considering
pipelines are a part--are additional information from DOT
projected to increase with on the physical condition of a
continued climate change. pipeline system, the Pipeline
Security Branch could better
inform its vulnerability
calculations. Additionally, TSA
could use the information to
help pipeline operators
identify security measures to
help reduce vulnerability of an
aging system because well-
maintained, safe pipelines are
more likely to tolerate a
physical attack.
----------------------------------------------------------------------------------------------------------------
cross-sector interdependencies The Pipeline Security V According to the NIPP,
Branch's pipeline risk understanding and addressing
assessment currently risks from cross-sector
considers the effects of a dependencies and
pipeline system's ability to interdependencies is essential
service assets such as major to enhancing critical
airports, the electric grid, infrastructure security and
and military bases. However, resilience.
consequence is calculated on Considering
the loss or disruption of the interdependencies of sectors in
pipeline system to these both directions could improve
other assets and does not the calculations in the
capture the dependency of the pipeline risk assessment.
pipeline system on other
energy sources, such as
electricity. Pipeline
Security Branch officials are
considering cross-sector
interdependencies and discuss
these factors with operators
as they relate to system
resiliency, but did not see a
direct link to pipeline
security.
----------------------------------------------------------------------------------------------------------------
Source: GAO Analysis of Transportation Security Administration Pipeline Relative Risk Ranking Tool data | GAO-19-
48
TSA's Pipeline Risk Assessment Has Not Been Peer Reviewed to Help
Validate the Data and Methodology
In addition to the shortfalls identified above, the risk assessment
has not been peer reviewed since its conception in 2007. In our past
work, we reported that independent, external peer reviews are a best
practice in risk management and that independent expert review panels
can provide objective reviews of complex issues.\80\ According to the
National Research Council of the National Academies, external peer
reviews should, among other things, address the structure of the
assessment, the types and certainty of the data, and how the assessment
is intended to be used. The National Research Council has also
recommended that DHS improve its risk analyses for infrastructure
protection by validating the assessments and submitting them to
independent, external peer review.\81\
---------------------------------------------------------------------------
\80\ See GAO, Coast Guard: Security Risk Model Meets DHS Criteria,
but More Training Could Enhance Its Use for Managing Programs and
Operations, GAO-12-14 (Washington, D.C.: Nov. 17, 2011); and Aviation
Security: Efforts to Validate TSA's Passenger Screening Behavior
Detection Program Underway, but Opportunities Exist to Strengthen
Validation and Address Operational Challenges, GAO-10-763 (Washington,
D.C.: May 20, 2011).
\81\ National Research Council of the National Academies, Review of
the Department of Homeland Security's Approach to Risk Analysis
(Washington, D.C., 2010).
---------------------------------------------------------------------------
Other DHS components have implemented our prior recommendations to
conduct peer reviews of their risk assessments.\82\ For example, in
April 2013, we reported on DHS's management of its Chemical Facility
Anti-Terrorism Standards (CFATS) program and found that the approach
used to assess risk did not consider all of the elements of
consequence, threat, and vulnerability associated with a terrorist
attack involving certain chemicals.\83\ The Infrastructure Security
Compliance Division, which manages the CFATS program conducted a
multiyear effort to improve their risk assessment methodology and
included commissioning a peer review by the Homeland Security Studies
and Analysis Institute, which resulted in multiple recommendations. As
part of the implementation of some of the peer review's
recommendations, DHS conducted peer reviews and technical reviews with
government organizations and facility owners and operators, and worked
with Sandia National Laboratories to verify and validate the CFATS
program's revised risk assessment methodology, which was completed in
January 2017.
---------------------------------------------------------------------------
\82\ See GAO, Critical Infrastructure Protection: DHS Efforts to
Assess Chemical Security Risk and Gather Feedback on Facility Outreach
Can Be Strengthened, GAO-13-353 (Washington, D.C.: Apr. 5, 2013). See
also GAO, Critical Infrastructure Protection: DHS List of Priority
Assets Needs to Be Validated and Reported to Congress, GAO-13-296
(Washington, D.C.: Mar 25, 2013). In this March 2013 report, we found
that changes to DHS's criteria for including assets on the National
Critical Infrastructure Prioritization Program (NCIPP) list of the
Nation's highest-priority critical infrastructure could hinder DHS's
ability to compare infrastructure across sectors and that a peer review
would better position DHS to reasonably assure that the NCIPP list
identifies the Nation's highest priority critical infrastructure. DHS
concurred with our recommendation, and in November 2013, DHS
commissioned a seven-member panel to review the NCIPP process, which
resulted in multiple observations, some of which DHS has taken steps to
address. DHS's commissioning of a review panel satisfied the intent of
our recommendation.
\83\ See GAO-13-353.
---------------------------------------------------------------------------
According to Pipeline Security Branch officials, they are
considering updates to the risk assessment methodology including
changes to the vulnerability and consequence factors. These officials
said the risk assessment was previously reviewed within the past 18
months by industry experts and they consider input from several Federal
partners including DHS, DOT, and the Department of Defense. Officials
also said they will consider input from industry experts and Federal
partners while working on updating the risk assessment. However, most
of the proposed changes to the risk assessment methodology officials
described are ones that have been deliberated since our last review in
2010.\84\ Therefore, an independent, external peer review would provide
the opportunity for integration and analysis of additional outside
expertise across the critical infrastructure community.
---------------------------------------------------------------------------
\84\ During our current review, Pipeline Security Branch officials
reported that they are considering updates to the risk assessment
methodology, including changes to vulnerability and consequence
factors. However, the updates officials reported they were considering
in 2018 are nearly identical to those that Pipeline Security Branch
officials reported they were considering making in 2011 in response to
our prior recommendation. These proposed changes were also present in
the 2014 version of the risk assessment.
---------------------------------------------------------------------------
While independent, external peer reviews cannot ensure the success
of a risk assessment approach, they can increase the probability of
success by improving the technical quality of projects and the
credibility of the decision-making process. According to the National
Research Council of the National Academies, independent, external peer
reviews should include validation and verification to ensure that the
structure of the risk assessment is both accurate and reliable. Thus,
an independent, external peer review would provide better assurance
that the Pipeline Security Branch can rank relative risk among pipeline
systems using the most comprehensive and accurate threat,
vulnerability, and consequence information.
TSA Has Established Performance Measures, but Limitations Hinder TSA's
Ability to Determine Pipeline Security Program Effectiveness
TSA has established performance measures, as well as databases to
monitor pipeline security reviews and analyze their results. However,
weaknesses in its performance measures and its efforts to record
pipeline security review recommendations limit its ability to determine
the extent that its pipeline security program has reduced pipeline
sector risks. Furthermore, we identified data reliability issues in the
information that TSA collects to track the status of pipeline security
review recommendations, such as missing data, inconsistent data entry
formats, and data entry errors.
TSA Has Established Performance Measures but Faces Challenges in
Assessing the Effectiveness of Its Efforts to Reduce Pipeline
Security Risks
TSA has three sets of performance measures for its pipeline
efforts: the Pipeline Security Plan in the 2018 Biennial National
Strategy for Transportation Security (NSTS), a management measure in
the DHS Fiscal Year 2019 congressional budget justification, and
summary figures in their CSR and CFSR databases. As a result of our
2010 work, TSA established performance measures and linked them to
Pipeline Security Plan goals within the Surface Security Plan of the
2018 NSTS.\85\ See table 5 below for the 2018 NSTS Pipeline Security
Plan performance measures.
---------------------------------------------------------------------------
\85\ The NSTS provides biennial risk-based plans for transportation
assets in the U.S. and identifies objectives which enhance the security
of transportation infrastructure. The strategy includes a base plan,
modal security plans, and an intermodal security plan. The Surface
Security Plan includes four modal security plans: Mass Transit and
Passenger Rail, Freight Rail, Highway and Motor Carrier, and Pipeline.
Table 5: 2018 NSTS Pipeline Security Plan Performance Measures, Goals 1
and 2
------------------------------------------------------------------------
Performance
Goal Objective Outcome Measurement
------------------------------------------------------------------------
NSTS Goal 1: Reduce the risks Improvement of Percentage of
Manage Risks to from a terrorist industry critical
Transportation attack on security plans pipeline
Systems from pipeline systems and security systems
Terrorist Attack through security planning implementing
and Enhance plans addressing through TSA Pipeline
System critical incorporation Security
Resilience infrastructure of TSA Pipeline Guidelines as
protection, Security assessed
operational Guidelines into through
practices (to existing corporate and
detect and security plans. facility
deter), and security
cybersecurity. reviews.
NSTS Goal 1: Conduct training Improved Percentage of
Manage Risks to of employees to capability of critical
Transportation identify, the industry pipeline
Systems from prevent, absorb, employees to systems
Terrorist Attack respond to, and identify, implementing
and Enhance recover from a prevent, TSA Pipeline
System terrorist absorb, respond Security
Resilience attack. to, and recover Guidelines as
from a physical assessed
and/or cyber through
terrorist corporate and
attack. facility
security
reviews.
NSTS Goal 1: Conduct exercises Pipeline systems Percentage of
Manage Risks to employing threat and public critical
Transportation scenarios to safety agencies pipeline
Systems from evaluate and are better systems
Terrorist Attack identify prepared to implementing
and Enhance opportunities to respond and TSA Pipeline
System improve security recover Security
Resilience preparedness and effectively in Guidelines as
resiliency. the event of assessed
security through
incidents. corporate and
facility
security
reviews.
NSTS Goal 2; Maintain and Improved domain Increased timely
Enhance enhance awareness distribution of
Effective Domain mechanisms for through timely time sensitive
Awareness of information and delivery of intelligence
Transportation intelligence relevant products.
Systems and sharing between intelligence
Threats the pipeline and information
industry and products for
government. pipeline
industry to
implement
mitigation
strategies to
reduce risk.
NSTS Goal 2; Encourage Pipeline Percentage of
Enhance industry industry, first critical
Effective Domain engagement with responders, and pipeline
Awareness of first responders neighboring systems
Transportation and the public communities implementing
Systems and to enhance working TSA Pipeline
Threats understanding of collectively to Security
community risks plan and Guidelines as
associated with prepare for assessed
pipeline incidents that through
systems. could disrupt corporate and
pipeline facility
operations and security
endanger the reviews.
community.
------------------------------------------------------------------------
Source: 2018 Biennial National Strategy for Transportation Security
(NSTS) | GAO-19-48
As shown in table 6 below, DHS also included a management measure
in its Fiscal Year 2019 congressional budget justification to track the
annual number of completed pipeline security reviews.
Table 6: Management Measure in DHS FY 2019 Congressional Budget
Justification
------------------------------------------------------------------------
Measure Description
------------------------------------------------------------------------
Number of High-Risk Pipeline Security Reviews assess and
Pipeline Systems on Which elevate the security posture of the
Security Reviews Were pipeline energy transportation mode.
Conducted. Information and recommendations from
pipeline corporate headquarters and field
site reviews inform critical energy
facility operators of issues to enhance
security from terrorism and criminal
activity. The onsite security reviews
develop firsthand knowledge of security
planning and execution of the critical
pipeline systems, establish communication
with key pipeline security personnel, and
identify and share smart practices. As
industry wide security gaps are identified
through the process, the TSA Surface
Division develops programs to address gaps
throughout the pipeline industry. Each
pipeline corporation is assessed every 4
to 5 years.
------------------------------------------------------------------------
Source: Department of Homeland Security (DHS) Transportation Security
Administration (TSA) Fiscal Year (FY) 2019 Congressional Budget
Justification | GAO-19-48
Finally, TSA Pipeline Security Branch officials said they use
summary figures in the CFSR status database and the CSR goals and
priorities database as performance measures.\86\ For example, these
include the percentage of CFSR recommendations implemented and the
average percentage compliance with the guidelines by Fiscal Year.
---------------------------------------------------------------------------
\86\ TSA provided us with four databases containing CSR and CFSR
information: Master CSR Recommendations Listing and Status (2010-2013),
U-SSI CSR Data FY16-17 (10-10-2017), U-SSI--CFSR Recommendations (10-
10-2017) Data (2010-2017), and U-SSI-CFSR Recommendations Analysis. The
first contained information on CSR recommendations and their most
recent status. The second contained information on CSRs conducted on
pipeline operators and their compliance with the guidelines arranged by
strategic goals and priorities. The third contained information on CFSR
recommendations made by TSA. Finally, the fourth contained information
on the most recent status of those CFSR recommendations. In order to
better distinguish their contents, from here on we refer to them as the
CSR recommendations database, the CSR goals and priorities database,
the CFSR recommendations database, and the CFSR status database.
---------------------------------------------------------------------------
We previously found that results-oriented organizations set
performance goals to clearly define desired program outcomes and
develop performance measures that are clearly linked to the performance
goals.\87\ Performance measures should focus on whether a program has
achieved measurable standards toward achieving program goals, and allow
agencies to monitor and report program accomplishments on an ongoing
basis. Our previous work on performance metrics identified 10
attributes of effective performance.\88\ Table 7 identifies each key
attribute of effective performance measures along with its definition.
---------------------------------------------------------------------------
\87\ GAO, Executive Guide: Effectively Implementing the Government
Performance and Results Act, GAO/GGD-96-118 (Washington, D.C.: June
1996); Managing for Results: Enhancing Agency Use of Performance
Information for Management Decision Making, GAO-05-927 (Washington,
D.C.: Sept. 9, 2005); and Veterans Justice Outreach Program: VA Could
Improve Management by Establishing Performance Measures and Fully
Assessing Risks, GAO-16-393 (Washington, D.C.: Apr. 28, 2016).
\88\ GAO, Military Personnel: DOD Needs to Establish Performance
Measures for the Armed Forces Sports Program, GAO-17-542 (Washington,
D.C.: June 8, 2017).
Table 7: Key Attributes of Effective Performance Measures
------------------------------------------------------------------------
Attribute Definition
------------------------------------------------------------------------
Balance A suite of measures ensures that an
organization's various priorities are covered.
Clarity Measure is clearly stated, and the name and
definition are consistent with the methodology
used to calculate it.
Core program activities Measures cover the activities that an entity is
expected to perform to support the intent of
the program.
Government-wide Each measure covers a priority such as quality,
priorities timeliness, and cost of service.
Limited overlap Measures provide new information beyond that
provided by other measures.
Linkage Measure is aligned with division-and agency-
wide goals and mission and is clearly
communicated throughout the organization.
Measurable target Measure has a numerical goal.
Objectivity Measure is reasonably free from significant
bias or manipulation.
Reliability Measure produces the same result under similar
conditions.
Baseline and trend data Measure has a baseline and trend data
associated with it to identify, monitor, and
report changes in performance and to help
ensure that performance is viewed in context.
------------------------------------------------------------------------
Source: GAO-17-542 | GAO-19-48
We evaluated the current performance measures included in the 2018
NSTS, the DHS Fiscal Year 2019 congressional budget justification, the
CSR goals and priorities database, and the CFSR status database related
to TSA's Pipeline Security Branch.
We primarily focused on key attributes which could be applied to
individual measures. These include clarity, linkage, measurable
targets, objectivity, reliability, and baseline and trend data. Our
prior work on performance measurement found that all performance
measure attributes are not equal and failure to have a particular
attribute does not necessarily indicate that there is a weakness in
that area or that the measure is not useful; rather, it may indicate an
opportunity for further refinement.\89\
---------------------------------------------------------------------------
\89\ GAO, Tax Administration: IRS Needs to Further Refine Its Tax
Filing Season Performance Measures, GAO-03-143 (Washington, D.C.: Nov.
22, 2002).
---------------------------------------------------------------------------
Based on our evaluation, the TSA-identified measures do not possess
attributes that we have identified as being key to successful
performance measures. As a result, TSA cannot fully determine the
extent to which the Pipeline Security Branch has achieved desired
outcomes, including the effectiveness of its efforts to reduce risks to
pipelines. Specifically, many of TSA's measures cover agency goals and
mission, but they generally lack clarity and measurable targets,
provide significantly overlapping information, and do not include
baseline and trend data.
Clarity. The pipeline-related measures in the 2018 NSTS are
not clear because they do not describe the methodology used to
calculate them, and the names and definitions are not clearly
described. For example, NSTS goal 1 includes an objective to
conduct training of employees responding to terrorist attacks.
The desired outcome is to improve the capability of industry
employees to respond and recover from terrorist attacks.
However, the performance measure is the percentage of critical
pipeline systems implementing the TSA Pipeline Security
Guidelines. It is not clear if this measure is specific to the
sections of the guidelines related to employee training or
overall implementation of the guidelines. The CFSR status
database measures include the percentage of recommendations
implemented by topic, such as ``Site Specific Security
Measures,'' ``Signage,'' or ``Miscellaneous.'' However, the
database does not specifically define these topics or explain
the methodology for calculating the measures.\90\ Unclear
measures could be confusing and misleading to users.
---------------------------------------------------------------------------
\90\ Formula calculations provide some explanation of how the
measures are calculated, although this may not be readily understood by
users who are unfamiliar with spreadsheet formulas.
Core program activities. The pipeline-related measures in
the 2018 NSTS cover some of the agency's core program
activities, such as conducting security exercises with the
pipeline industry and providing intelligence and information
products to the industry. However, the NSTS Pipeline Security
Plan measures do not specifically include some core program
activities,\91\ such as updating the TSA Pipeline Security
Guidelines or the results of conducting CSRs and CFSRs in order
to collect the information necessary for the existing
performance measures. The CSR goals and priorities database and
the CFSR status database include measures intended to track
some of the results of pipeline security reviews, such as the
average percentage compliance with the guidelines by Fiscal
Year and the percentage of CFSR recommendations implemented. If
core program activities are not covered, there may not be
enough information available in those areas to managers and
stakeholders.
---------------------------------------------------------------------------
\91\ For the purposes of this report, the core program activities
were those described in the Pipeline Security Guidelines and the 2018
NSTS Pipeline Security Plan. These include developing and updating the
guidelines; conducting CSRs and CFSRs; conducting exercises to evaluate
preparedness for, response to, and recovery from physical and cyber
security incidents; providing timely and relevant intelligence and
information to industry; and promoting pipeline security awareness in
communities surrounding critical pipeline assets and systems.
Limited overlap. The pipeline-related measures in the 2018
NSTS do not have limited overlap. As discussed previously, four
of the five NSTS measures are based on the percentage of
critical pipeline systems implementing TSA's Pipeline Security
Guidelines. The management measure is based on the number of
complete pipeline security reviews. The CFSR status database
measures are based on the percentage of recommendations
implemented overall and by groups. Finally, the CSR goals and
priorities database measures are based on the average
compliance percentage of companies that had CSRs conducted in
Fiscal Years 2016 and 2017. This is similar to four of the five
NSTS measures. Significantly overlapping measures may lead to
redundant, costly information that does not add value for TSA
---------------------------------------------------------------------------
management.
Linkage. The pipeline-related measures in the 2018 NSTS
generally exhibited this key attribute. For example, all of the
NSTS measures were arranged by agency strategic goals and risk-
based priorities. However, the management measure in DHS's
Fiscal Year 2019 congressional budget justification and the
CFSR status database measures did not specify the TSA goals and
priorities to which they were aligned. If measures are not
aligned with division and agency-wide goals and mission, the
behaviors and incentives created by these measures do not
support achieving those goals or mission.
Measurable target. TSA's measures generally did not include
measurable targets in the form of a numerical goal and none of
the NSTS measures had measurable targets. For example, the NSTS
measure under the Security Planning priority, which tracks the
percentage of critical pipeline systems implementing TSA's
Pipeline Security Guidelines, does not state what specific
percentages would be considered an improvement in industry
security plans. However, the management measure did include
target numbers of pipeline security reviews by Fiscal Year.
Both the CFSR status database measures and CSR goals and
priorities database measures did not include measurable
targets. Without measurable targets, TSA cannot tell if
performance is meeting expectations.
Objectivity. Because the pipeline-related measures in the
2018 NSTS, the CFSR status database, and the CSR goals and
priorities database generally lack clarity and measurable
targets, TSA cannot ensure its measures are free from bias or
manipulation, and therefore, are not objective. If measures are
not objective, the results of performance assessments may be
systematically overstated or understated.
Reliability. Because the pipeline-related measures in the
2018 NSTS, the CFSR status database, and the CSR goals and
priorities database generally lack clarity, measurable targets,
and baseline and trend data, it is not clear if TSA's measures
produce the same result under similar conditions; therefore,
the pipeline-related measures are unreliable. If measures are
not reliable, reported performance data may be inconsistent and
add uncertainty.
Baseline and trend data. TSA's measures generally did not
include baseline and trend data. For example, none of the NSTS
measures included past results and compared them to measurable
targets. TSA officials were unable to identify measures or
goals to assess the extent to which pipeline operators have
fully implemented the guidelines or increased pipeline
security, but did say developing a feedback mechanism to
measure progress in closing vulnerability gaps was important.
However, the management measure did include the number of
completed pipeline security reviews for each Fiscal Year from
2014 through 2017, as well as numerical goals. The CFSR status
database includes information on CFSRs conducted from May 22,
2012, through June 29, 2017, but the measures are calculated
for the entire time period rather than year-by-year. The CSR
goals and priorities database measures include percentage
compliance with the guidelines for CSRs conducted in Fiscal
Years 2016 and 2017, as well as a combined measure. However,
baseline and trend data are not tracked or reported in either
database. Collecting, tracking, developing, and reporting
baseline and trend data allows agencies to better evaluate
progress being made and whether or not goals are being
achieved.
Pipeline Security Branch officials explained that in addition to
the measures reported in the 2018 NSTS Pipeline Security Plan, they
primarily rely on measures assessing CSR and CFSR implementation for
assessing the value of its pipeline security program. TSA officials
reported that they collect and analyze data and information collected
from CSRs and CFSRs to, among other things, determine strengths and
weaknesses at critical pipeline facilities, areas to target for risk
reduction strategies, and pipeline industry implementation of the
voluntary Pipeline Security Guidelines. For example, TSA officials
reported that they analyzed information from approximately 734 CFSR
recommendations that were made during Fiscal Years 2012 through 2016.
They found that pipeline operators had made the strongest improvements
in security training, public awareness outreach and law enforcement
coordination, and site specific security measures. The most common
areas in need of improvement were 24x7 monitoring, frequency of
security vulnerability assessments, and proper signage.
However, as described above, we found those measures also did not
comport with key attributes for successful measures and we report below
on reliability concerns for underlying data supporting those measures.
In addition, while the Pipeline Security Branch may not rely on the
measures included in the 2018 NSTS Pipeline Security Plan and the
Fiscal Year 2019 congressional budget justification, they are important
for reporting the status of pipeline security efforts to TSA as a whole
and to external stakeholders such as Congress.
Taking steps to ensure that the pipeline security program
performance measures exhibit key attributes of successful performance
measures could allow TSA to better assess the program's effectiveness
at reducing pipeline physical and cybersecurity risks. This could
include steps such as modifying its suite of measures so they are
clear, have measurable targets, and add baseline and trend data.
Further examples include the following:
Adding measurable targets consisting of numerical goals
could allow TSA to better determine if the pipeline security
program is meeting expectations. For example, measurable
targets could be added to TSA's existing measures by developing
annual goals for the percentage of recommendations implemented
to the CFSR status database and then reporting annual results.
To make measures clearer, TSA could verify that each measure
has a clearly stated name, definition, and methodology for how
the measure is calculated. For example, the NSTS objective for
security training mentioned above could have more specific
language explaining how the measure is calculated and whether
it applies to pipeline operators' implementation of the
training-related portions of the TSA Pipeline Security
Guidelines or overall implementation.
Finally, adding baseline and trend data could allow TSA to
identify, monitor, and report changes in performance and help
ensure that performance is viewed in context. For example, the
NSTS measures, CFSR status database measures, and CSR goals and
priorities database measures could have annual results from
prior years. This could help TSA and external stakeholders
evaluate the effectiveness of the pipeline security program and
whether it is making progress toward its goals.
TSA Does Not Track the Implementation Status of Past CSR
Recommendations, and Supporting Data Are Not Sufficiently
Reliable
According to TSA officials, the primary means for assessing the
effectiveness of the agency's efforts to reduce pipeline security risks
is through conducting pipeline security reviews--Corporate Security
Reviews (CSRs) and Critical Facility Security Reviews (CFSRs). However,
TSA has not tracked the status of CSR recommendations for over 5 years
and related security review data are not sufficiently reliable.
When conducting CSRs and CFSRs, TSA staff makes recommendations to
operators, if appropriate. For example, a CSR recommendation might
include a suggestion to conduct annual security-related drills and
exercises, and a CFSR recommendation might include a suggestion to
install barbed wire on the main gate of a pipeline facility. In
response to recommendations that we made in our 2010 report, TSA
developed three databases to track CSR and CFSR recommendations and
their implementation status by pipeline facility, system, operator, and
product type.\92\ In addition, the agency recently developed a fourth
database to collect and analyze information gathered from pipeline
operators' responses to CSR questions. TSA officials reported that they
use this database to assess the extent that TSA's pipeline security
program has met NSTS goals and Pipeline Security Branch priorities. TSA
officials stated that they use the CSR goals and priorities database
for follow-up on recommendations, indications of improvement in
pipeline security, and as an input into TSA performance goals and
measures, including the performance measures for the 2018 NSTS Pipeline
Security Plan.
---------------------------------------------------------------------------
\92\ GAO, Pipeline Security: TSA Has Taken Actions to Help
Strengthen Security, but Could Improve Priority-Setting and Assessment
Processes, GAO-10-867 (Washington, D.C.: Aug. 4, 2010).
---------------------------------------------------------------------------
We found several problems with the databases that indicate that the
pipeline security program data are not sufficiently reliable and do not
provide quality information that is current, complete, and accurate.
First, the CSR recommendations database only included information for
reviews conducted from November 2010 through February 2013. TSA
officials stated that the agency stopped capturing CSR recommendations
and status information in 2014. A TSA official stated that one factor
was that the pipeline staffing level was one FTE in Fiscal Year 2014.
However, the Pipeline Security Branch did not resume entering CSR
recommendation-related information when staffing levels rose to 6 FTEs
in the following year and beyond. As a result, TSA is missing over 5
years of data for the recommendations it made to pipeline operators
when conducting CSRs.
The agency collected some information from CSRs conducted in Fiscal
Years 2016 and 2017 in the separate CSR goals and priorities database.
However, this database does not include all of the information that TSA
collects when conducting CSRs. Specifically, the CSR goals and
priorities database does not state which companies were reviewed, what
specific recommendations were made, or the current status of those
recommendations, and only records operators' responses to 79 of the 222
CSR questions.
Second, our review identified instances of missing data,
inconsistent data entry formats, and data entry errors in the four
databases. For example:
The CSR recommendations database had missing data in all 13
of the included fields and a data entry error shifted 50
observations into the wrong fields, impacting both the Status
Date and Completion Code fields.\93\
---------------------------------------------------------------------------
\93\ For example, 3 fields had 1 percent or less missing data, 7
fields had approximately 2 percent, 2 fields had 17 percent, and 1
field had 18 percent. Further, we found that 6 out of 13 fields had
inconsistent data entry formats or allowed unrestricted text entries.
For example, the Status field describes the current status of TSA's
recommendations and includes entries such as ``1'',''(1) Completed'',
and ``Completed using alternative strategy''.
The CSR goals and priorities database had seven entries with
inconsistent data formatting and five of those entries were not
taken into account when calculating summary figures.\94\
---------------------------------------------------------------------------
\94\ For example, in Fiscal Year 2017 under a CSR question related
to elements addressed in the corporate security plan, Company 7 had a
``1'' entered for ``Yes'' under ``Other.'' The entry does not include
an explanation, and it is not included in the summary calculation for
the company.
The CFSR recommendations database had missing data in 3 of 9
fields.\95\ There was also inconsistent data entry formats in 3
fields.\96\
---------------------------------------------------------------------------
\95\ For example, the City, Recommendation, and Group fields had
approximately 1 percent missing data.
\96\ For example, based on a legend included in the database, the
Group field assigns values of 1 through 13 which represent different
areas of physical security. However, there are three out-of-range
entries of ``0''.
The CFSR status database had missing data in 7 of 29
fields\97\ and inconsistent data entry formats in 4 fields.\98\
---------------------------------------------------------------------------
\97\ For example, 1 field had 1 percent missing data, 3 fields had
5 percent, 2 fields had 32 percent, and 1 field had 46 percent.
\98\ For example, the Status Date field included entries such as
``4/11/2014'', ''Estimated Completion 12/31/2017'', and ''Evergreen/
Annually''.
Finally, TSA has not documented its data entry and verification
procedures, such as in a data dictionary or user manual, and does not
have electronic safeguards for out-of-range or inconsistent entries for
any of the databases it uses to track the status of CSR or CFSR
recommendations and analyze operator responses to the CSR. TSA Pipeline
Security Branch officials told us that they had not documented data
entry and verification procedures and did not have electronic
safeguards. This was for two reasons. First, the officials stated that
the databases are small and maintained in a commercial spreadsheet
program that does not allow for electronic safeguards. However, based
on our review of the databases, the spreadsheet program does allow for
a variety of electronic safeguards. For example, entries can be
restricted to only allow selections from a drop-down list or only allow
dates to be entered. Second, only a small number of TSA employees enter
information into these databases. TSA officials explained that
typically one TSA employee is responsible for entering information from
pipeline security reviews, and another individual, usually whoever
conducted the review, is tasked to verify the accuracy of the data
entered. As a result, according to the officials, any errors would be
self-evident and caught during these TSA employees' reviews.
Our work has emphasized the importance of quality information for
management to make informed decisions and evaluate agencies'
performance in achieving key objectives and addressing risks. The
Standards for Internal Control in the Federal Government states that
management should use quality information to achieve agency objectives,
where ``quality'' means, among other characteristics, current,
complete, and accurate.\99\ In addition, DHS's Information Quality
Guidelines state that all DHS component agencies should treat
information quality as integral to every step of the development of
information, including creation, collection, maintenance, and
dissemination. The guidelines also state that agencies should
substantiate the quality of the information disseminated through
documentation or other appropriate means.\100\
---------------------------------------------------------------------------
\99\ GAO-14-704G.
\100\ Department of Homeland Security, Information Quality
Guidelines, (Washington, D.C.: Mar. 2011).
---------------------------------------------------------------------------
Without current, complete, and accurate information, it is
difficult for TSA to evaluate the performance of the pipeline security
program. Until TSA monitors and records the status of these reviews'
recommendations, it will be hindered in its efforts to determine
whether its recommendations are leading to significant reduction in
risk. By entering information on CSR recommendations and monitoring and
recording their status, developing written documentation of its data
entry and verification procedures and electronic safeguards, and
improving the quality of its pipeline security program data, TSA could
better ensure it has the information necessary to effectively monitor
pipeline operators' progress in improving their security posture, and
evaluate its pipeline security program's effectiveness in reducing
security risks to pipelines.
Conclusions
A successful pipeline attack could have dire consequences on public
health and safety, as well as the U.S. economy. Recent coordinated
campaigns by environmental activists to disrupt pipeline operations,
and the successful attempts by nation-state actors to infiltrate and
obtain sensitive information from pipeline operators' business and
operating systems, demonstrate the dynamic and continuous threat to the
security of our Nation's pipeline network.
To help ensure the safety of our pipelines throughout the nation,
it is important for TSA to address weaknesses in the management of its
pipeline security program. TSA's Pipeline Security Branch revised its
security guidelines in March 2018 to, among other things, reflect the
dynamic threat environment and incorporate NIST's Cybersecurity
Framework cybersecurity principles and practices.\101\ However, without
a documented process defining how frequently TSA is to review and, if
deemed necessary, revise its guidelines, TSA cannot ensure that its
guidelines reflect the latest known standards and best practices for
physical and cybersecurity, or address the persistent and dynamic
security threat environment currently facing the Nation's pipeline
system. Further, without clearly defined criteria for determining
pipeline facilities' criticality, TSA cannot ensure that pipeline
operators are applying guidance uniformly and that all of the critical
facilities across the pipeline sector have been identified; or that
their vulnerabilities have been identified and addressed.
---------------------------------------------------------------------------
\101\ Five of the 10 pipeline operators we interviewed
characterized the guidelines as effective in helping to secure their
operations, one operator was neutral, and the remaining four did not
comment on the guidelines' effectiveness.
---------------------------------------------------------------------------
TSA could improve its ability to conduct pipeline security reviews
and the means that it uses to prioritize which pipeline systems to
review based on their relative risk ranking. Establishing a strategic
workforce plan could help TSA ensure that it has identified the
necessary skills, competencies, and staffing allocations that the
Pipeline Security Branch needs to carry out its responsibilities,
including conducting security reviews of critical pipeline companies
and facilities, as well as their cybersecurity posture. Better
considering threat, vulnerability, and consequence elements in its risk
assessment and incorporating an independent, external peer review in
its process would provide more assurance that the Pipeline Security
Branch ranks relative risk among pipeline systems using comprehensive
and accurate data and methods.
TSA could also improve its ability to assess the extent to which
the Pipeline Security Branch has met its goals. Taking steps to ensure
that the pipeline security program performance measures exhibit key
attributes of successful performance measures could allow TSA to better
assess the program's effectiveness at reducing pipeline physical and
cybersecurity risks. Without current, complete, and accurate
information, it is difficult for TSA to evaluate the performance of the
pipeline security program. By monitoring and recording the status of
CSR recommendations, developing written documentation of its data entry
and verification procedures and electronic safeguards, and improving
the quality of its pipeline security program data, TSA could better
ensure it has the information necessary to effectively monitor pipeline
operators' progress in improving their security posture, and evaluate
its pipeline security program's effectiveness in reducing security
risks to pipelines.
Until TSA monitors and records the status of these reviews'
recommendations, it will be hindered in its efforts to determine
whether its recommendations are leading to significant reduction in
risk.
Recommendations for Executive Action
We are making 10 recommendations to TSA:
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to implement a
documented process for reviewing, and if deemed necessary, for
revising TSA's Pipeline Security Guidelines at regular defined
intervals. (Recommendation 1)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to clarify TSA's
Pipeline Security Guidelines by defining key terms within its
criteria for determining critical facilities. (Recommendation
2)
The TSA Administrator should develop a strategic workforce
plan for its Security Policy and Industry Engagement's Surface
Division, which could include determining the number of
personnel necessary to meet the goals set for its Pipeline
Security Branch, as well as the knowledge, skills, and
abilities, including cybersecurity, that are needed to
effectively conduct CSRs and CFSRs. (Recommendation 3)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to update the Pipeline
Relative Risk Ranking Tool to include up-to-date data to ensure
it reflects industry conditions, including throughput and
threat data. (Recommendation 4)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to fully document the
data sources, underlying assumptions and judgments that form
the basis of the Pipeline Relative Risk Ranking Tool, including
sources of uncertainty and any implications for interpreting
the results from the assessment. (Recommendation 5)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to identify or develop
other data sources relevant to threat, vulnerability, and
consequence consistent with the NIPP and DHS critical
infrastructure risk mitigation priorities and incorporate that
data into the Pipeline Relative Risk Ranking Tool to assess
relative risk of critical pipeline systems, which could include
data on prior attacks, natural hazards, feedback data on
pipeline system performance, physical pipeline condition, and
cross-sector interdependencies. (Recommendation 6)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to take steps to
coordinate an independent, external peer review of its Pipeline
Relative Risk Ranking Tool, after the Pipeline Security Branch
completes enhancements to its risk assessment approach.
(Recommendation 7)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to ensure that it has a
suite of performance measures which exhibit key attributes of
successful performance measures, including measurable targets,
clarity, and baseline and trend data. (Recommendation 8)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to take steps to enter
information on CSR recommendations and monitor and record their
status. (Recommendation 9)
The TSA Administrator should direct the Security Policy and
Industry Engagement's Surface Division to improve the quality
of its pipeline security program data by developing written
documentation of its data entry and verification procedures,
implementing standardized data entry formats, and correcting
existing data entry errors. (Recommendation 10)
Agency Comments and Our Evaluation
We provided a draft of this report to DHS, DOE, DOT, and FERC. DHS
provided written comments which are reproduced in appendix III. In its
comments, DHS concurred with our recommendations and described actions
planned to address them. DHS, DOE, DOT, FERC, also provided technical
comments, which we incorporated as appropriate. We also provided draft
excerpts of this product to the American Petroleum Institute (API), the
Association of Oil Pipe Lines, the American Gas Association (AGA), the
Interstate Natural Gas Association of America (INGAA), the American
Public Gas Association, and the selected pipeline operators that we
interviewed. For those who provided technical comments, we incorporated
them as appropriate.
With regard to our first recommendation, that TSA implement a
documented process for reviewing, and if deemed necessary, for revising
its Pipeline Security Guidelines at regular defined intervals, DHS
stated that TSA will implement a documented process for reviewing and
revising its Pipeline Security Guidelines at regular defined intervals,
as appropriate. DHS estimated that this effort would be completed by
March 31, 2019. This action, if fully implemented, should address the
intent of the recommendation.
With regard to our second recommendation, that TSA clarify its
Pipeline Security Guidelines by defining key terms within its criteria
for determining critical facilities, DHS stated that TSA will clarify
its Pipeline Security Guidelines by defining key terms within its
criteria for determining critical facilities. DHS estimated that this
effort would be completed by May 31, 2019. This action, if fully
implemented, should address the intent of the recommendation.
With regard to our third recommendation, that TSA develop a
strategic workforce plan for its Security Policy and Industry
Engagement's Surface Division, DHS stated that TSA will develop a
strategic workforce plan for the division, which includes determining
the number of personnel necessary to meet the goals set for the
Pipeline Security Branch, as well as the knowledge, skills, and
abilities, including cybersecurity, that are needed to effectively
conduct CSRs and CFSRs. DHS estimated that this effort would be
completed by June 30, 2019. This action, if fully implemented, should
address the intent of the recommendation.
With regard to our fourth recommendation, that TSA update the
Pipeline Relative Risk Ranking Tool to include up-to-date data in order
to ensure it reflects industry conditions, including throughput and
threat data, DHS stated that TSA will update the Pipeline Relative Risk
Ranking Tool to include up-to-date data in order to ensure it reflects
industry conditions, including throughput and threat data. DHS
estimated that this effort would be completed by February 28, 2019.
This action, if fully implemented, should address the intent of the
recommendation.
With regard to our fifth recommendation, that TSA fully document
the data sources, underlying assumptions, and judgements that form the
basis of the Pipeline Relative Risk Ranking Tool, including sources of
uncertainty and any implications for interpreting the results from the
assessment, DHS stated that TSA will fully document the data sources,
underlying assumptions, and judgements that form the basis of the
Pipeline Relative Risk Ranking Tool. According to DHS, this will
include sources of uncertainty and any implications for interpreting
the results from the assessment. DHS estimated that this effort would
be completed by February 28, 2019. This action, if fully implemented,
should address the intent of the recommendation.
With regard to our sixth recommendation, that TSA identify or
develop other data sources relevant to threat, vulnerability, and
consequence consistent with the NIPP and DHS critical infrastructure
risk mitigation priorities and incorporate that data into the Pipeline
Relative Risk Ranking Tool to assess relative risk of critical pipeline
systems, DHS stated that TSA will identify and/or develop other sources
relevant to threat, vulnerability, and consequence consistent with the
NIPP and DHS critical infrastructure risk mitigation priorities. DHS
also stated that TSA will incorporate that data into the Pipeline Risk
Ranking Tool to assess relative risk of critical pipeline systems,
which could include data on prior attacks, natural hazards, feedback
data on pipeline system performance, physical pipeline condition, and
cross-sector interdependencies. DHS estimated that this effort would be
completed by June 30, 2019. This action, if fully implemented, should
address the intent of the recommendation.
With regard to our seventh recommendation, that TSA take steps to
coordinate an independent, external peer review of its Pipeline
Relative Risk Ranking Tool, after the Pipeline Security Branch
completes enhancements to its risk assessment approach, DHS stated
that, after completing enhancements to its risk assessment approach,
TSA will take steps to coordinate an independent, external peer review
of its Pipeline Relative Risk Ranking Tool. DHS estimated that this
effort would be completed by November 30, 2019. This action, if fully
implemented, should address the intent of the recommendation.
With regard to our eighth recommendation, that TSA ensure that the
Security Policy and Industry Engagement's Surface Division has a suite
of performance measures which exhibit key attributes of successful
performance measures, including measurable targets, clarity, baseline,
and trend data, DHS stated that TSA's Surface Division's Pipeline
Section will develop both physical and cyber security performance
measures, in consultation with pipeline stakeholders, to ensure that it
has a suite of performance measures which exhibit key attributes of
successful performance measures, including measurable targets, clarity,
baseline, and trend data. DHS estimated that this effort would be
completed by November 30, 2019. This action, if fully implemented,
should address the intent of the recommendation.
With regard to our ninth recommendation, that TSA take steps to
enter information on CSR recommendations and monitor and record their
status, DHS stated that TSA will enter information on CSR
recommendations and monitor and record their status. DHS estimated that
this effort would be completed by October 31, 2019. This action, if
fully implemented, should address the intent of the recommendation.
With regard to our tenth recommendation, that TSA take steps to
improve the quality of its pipeline security program data by developing
written documentation of its data entry and verification procedures,
implementing standardized data entry formats, and correcting existing
data entry errors, DHS stated that TSA will develop written
documentation of its data entry and verification procedures,
implementing standardized data entry formats, and correcting existing
data entry errors. DHS estimated that this effort would be completed by
July 31, 2019. This action, if fully implemented, should address the
intent of the recommendation.
As agreed with your offices, unless you publicly announce the
contents of this report earlier, we plan no further distribution until
one day from the report date. At that time, we will send copies to the
appropriate congressional committees; the Secretaries of Energy,
Homeland Security, and Transportation; the Executive Director of the
Federal Energy Regulatory Committee; and other interested parties. In
addition, the report is available at no charge on the GAO website at
http://www.gao.gov.
If you or your staff have any questions about this report, please
contact Chris Currie at (404) 679-1875 or curriec@gao.gov, and Nick
Marinos at (202) 512-9342 or marinosn@gao.gov. Key contributors to this
report are listed in appendix IV.
Chris P. Currie,
Director,
Homeland Security and Justice Issues.
Nick Marinos,
Director,
Cybersecurity and Data Protection Issues.
______
List of Requesters
The Honorable Ron Johnson
Chairman
The Honorable Claire McCaskill
Ranking Member
Committee on Homeland Security and Governmental Affairs
Unites States Senate
The Honorable Maria Cantwell
Ranking Member
Committee on Energy and Natural Resources
United States Senate
The Honorable Michael McCaul
Chairman
Committee on Homeland Security
House of Representatives
The Honorable John Katko
Chairman
Subcommittee on Transportation and Protective Security
Committee on Homeland Security
House of Representatives
The Honorable Peter DeFazio
Ranking Member
Committee on Transportation and Infrastructure
House of Representatives
The Honorable Frank Pallone
Ranking Member
Committee on Energy and Commerce
House of Representatives
The Honorable Daniel Lipinski
Member of Congress
House of Representatives
______
Appendix I: Federal and Industry Security Guidelines and Standards for
the Pipeline Sector
This appendix lists security guidance and guidance-related tools
that the pipeline operators and industry association officials we
interviewed identified as adopted or available in order to secure their
physical and cyber operations. This list should not be considered to
include all physical and cybersecurity guidance that may be available
or used by all pipeline operators nor do all operators use all guidance
listed.
Table 8: Federal and Industry Guidelines and Regulations Identified as Applicable to Security by Selected
Pipeline Operators
----------------------------------------------------------------------------------------------------------------
Document Title
----------------------------------------------------------------------------------------------------------------
American Gas Association (AGA), AGA and Interstate Natural Gas Association of America (INGAA),
Security Practices Guidelines Natural Gas Industry Transmission and Distribution, May 2008
American National Standards Institute (ANSI)/International Society of Automation (ISA)-95.00.01-
CDV3, Enterprise-Control System Integration Part 1: Models and Terminology (2008)
American Petroleum Institute (API), Security Guidelines for the Petroleum Industry, Third Edition,
April 2005
API, Pipeline SCADA Security, API Standard 1164, Second Edition, October 2016
Canadian Standards Association (CSA) Z246.1-17: Security Management for Petroleum and Natural Gas
Industry Systems, March 1, 2017
CARVER (criticality, accessibility, recuperability, vulnerability, effect, and recognizability) +
Shock Vulnerability Assessment Tool
Center for Internet Security Critical Security Controls
Department of Energy (DOE) ONG Cybersecurity Capability Maturity Model (ONG C2M2) program
Department of Homeland Security (DHS), Cyber Security Evaluation Tool (CSET)
DHS Chemical Facility Antiterrorism Standards (CFATS)
Department of Transportation, Federal Pipeline Safety Regulations
DHS Infrastructure Survey Tool
INGAA, Control System Cyber Security Guidelines for the Natural Gas Pipeline Industry, January 31,
2011
International Organization for Standardization (ISO) and International Electrochemical Commission
(IEC), 17799/27001/27002, Information technology--Security techniques--Code of Practice for
Information Security Management
ISO/IEC 27001:2005: Information technology--Security Techniques--Information Security Management
Systems--Requirements
ISO 31000--Risk Management
International Electrotechnical Commission 62443--Security for Industrial Automation and Control
Systems
Maritime Transportation Security Act of 2002 (Public Law 107-295)
National Energy Board (NEB) Onshore Pipeline Regulations (OPR) SOR/99-294, June 19, 2016
National Institute of Standards and Technology (NIST), Special Publication (SP) 800-53: Security
and Privacy Controls for Federal Information Systems and Organizations, April 2013
NIST, Framework for Improving Critical Infrastructure Cybersecurity Version 1.1, April 16, 2018
NIST, SP 800-82: Guide to Industrial Control Systems (ICS) Security Revision 2, May 2015
North American Electric Reliability Corporation, Critical Infrastructure Protection (CIP) standards
----------------------------------------------------------------------------------------------------------------
Source: GAO analysis of pipeline operator information. | GAO-19-48
______
Appendix II: Description of Areas for Improvement in the Pipeline
Security Branch's Pipeline Relative Risk Ranking Tool
The Transportation Security Administration's (TSA) Pipeline
Security Branch developed the Pipeline Relative Risk Ranking Tool (risk
assessment) in 2007.\1\ The risk assessment calculates threat,
vulnerability, and consequence on variables such as the amount of
throughput in the pipeline system (consequence input). Pipeline
Security Branch officials told us that they use the pipeline risk
assessment to rank relative risk of the top 100 critical pipeline
systems, and the standard operating procedures for conducting Corporate
Security Reviews (CSR) state the results of the risk ranking are the
primary factor considered when prioritizing CSRs of pipeline
companies.\2\
---------------------------------------------------------------------------
\1\ According to DHS, a risk assessment is a product or process
which collects information and assigns values to risks for the purpose
of informing priorities, developing or comparing courses of action, and
informing decision making. A risk assessment is also considered the
appraisal of the risks facing an entity, asset, system, network,
geographic area or other grouping. See DHS Risk Lexicon, 2010.
\2\ In August 2010, we recommended, among other things, that the
Pipeline Security Branch document a methodology for scheduling CSRs
that considers a pipeline system's risk ranking as the primary
scheduling criteria and to balance that with other practical
considerations. As a result, the Pipeline Security Branch revised its
CSR Standard Operating Procedures, as documented in a copy dated May
20, 2011, to state that the primary criteria for scheduling CSR visits
is the pipeline system's relative risk (i.e., risk ranking), although
other factors and considerations, such as operator availability and
geographic location, will also play a role. Version 4.4, dated April
24, 2012, includes the same language. See GAO-10-867.
---------------------------------------------------------------------------
However, we identified several factors that likely limit the
usefulness of the current assessment in calculating threat,
vulnerability, and consequence to allow the Pipeline Security Branch to
effectively prioritize reviews of pipeline systems. For example,
because the risk assessment has not changed since 2014, information on
threat may be outdated.
Additionally, sources of data and underlying assumption and
judgments regarding certain threat and vulnerability inputs to the
assessment are not fully documented. For example, threats to
cybersecurity are not specifically accounted for in the description of
the risk assessment methodology, making it unclear if cybersecurity is
part of the assessment's threat factor. Further, the risk assessment
does not include information that is consistent with the National
Infrastructure Protection Plan (NIPP) and other Department of Homeland
Security (DHS) priorities for critical infrastructure risk mitigation,
such as information on natural hazards and the ability to measure risk
reduction (feedback data).
According to Pipeline Security Branch officials, the risk ranking
assessment is not intended to be a fully developed risk model detailing
all pipeline factors influencing risk. Rather, officials said they are
primarily interested in assessing risk data that impacts security.
However, because TSA's Pipeline Security Program is designed to enhance
the security preparedness of the pipeline systems, incorporating
additional factors that enhance security into their risk calculation of
the most critical pipeline systems would better align their efforts
with Presidential Policy Directive 21 (PPD-21). For example, PPD-21
calls for agencies to integrate and analyze information to prioritize
assets and manage risks to critical infrastructure, as well as
anticipate interdependencies and cascading impacts.
Below we present the various shortfalls in the risk assessment--
outdated data, limited description of sources and methodology, and
opportunities to better align with the NIPP and other DHS priorities
for critical infrastructure risk mitigation--in the context of the
components that comprise a risk assessment: threat, vulnerability, and
consequence.
Whereas in 2010 we made recommendations to improve the consequence
component in the pipeline relative risk ranking tool, we have currently
identified shortfalls that cut across all risk components: threat,
vulnerability, and consequence.
Threat
We identified several shortfalls in the pipeline risk assessment's
calculation of threat. First, while the risk assessment assesses
consequence and vulnerability by pipeline system through use of
multiple variables, it currently ranks threat for pipeline systems
equally. Second, the evolving nature of threats to pipelines may not be
reflected, since the risk assessment was last updated in 2014. Third,
the threat calculation does not take into account natural hazards.
Pipeline Security Branch officials said they currently rank threat
equally across pipeline systems because they do not have granular
enough threat information to distinguish threat by pipeline. However,
ranking threat equally effectively has no effect on the risk
calculation for pipeline systems. Further, this judgment is not
documented in the risk assessment's methodology. According to the NIPP,
a risk assessment's methodology must clearly document what information
is used and how it is synthesized to generate a risk estimate,
including any assumptions and judgments. Additionally, our analysis of
the pipeline risk assessment found that it includes at least one field
that TSA could use to differentiate threat by pipeline. Specifically,
the risk assessment includes a field that accounts for whether a
pipeline experienced a previous security threat (including failed
attacks), and information provided by Pipeline Security Branch suggests
some pipeline systems have experienced such threats.
However, the Pipeline Security Branch did not capture these events
in the risk assessment's calculation, which Pipeline Security Branch
officials said should be part of the threat calculation, but could not
account for why they were not calculated for the systems in the risk
assessment. These officials also clarified that incidents such as
suspicious photography or vandalism do not constitute an attack to be
accounted for in the threat calculation. Documenting such assumptions,
judgments, or decisions to exclude information could provide increased
transparency to those expected to interpret or use the results.
Pipeline Security Branch officials also said that they ranked
threat equally because TSA Intelligence and Analysis data show that
threats to the oil and natural gas sector have been historically low,
and Intelligence and Analysis does not conduct specific threat analysis
against individual pipeline systems. However, the Pipeline Security
Branch has not updated the risk assessment since June 2014; therefore,
the threat information it used to determine threat calculations--and
decide to rank threat equally--may be outdated and not reflect the
threats to the industry that have emerged in recent years. In fact,
pipeline operators we interviewed indicated that the types of threats
that concern pipeline operators have evolved. For example, 5 of the 10
operators we interviewed indicated that environmental activists were an
increased threat to the pipeline industry because they use sabotage
techniques, such as valve turning and cutting in service pipelines with
blow torches, against pipelines. Additionally, 6 of 10 pipeline
operators we interviewed said cyber attacks from nation-state actors
were a primary threat to their industry. Further, when TSA issued its
revised Pipeline Security Guidelines in March 2018, it stated that its
revisions to the guidelines were made to reflect the ever-changing
threat environment in both the physical and cybersecurity realms.
However, threats to cybersecurity are not specifically accounted for in
the description of the risk assessment methodology. Recent Pipeline
Modal and Cyber Modal Threat Assessments include cyber threats to the
pipeline industry, but the description of the pipeline risk
assessment's methodology does not specify what types of threat
assessments (sources) are used to calculate its threat score. To better
align with the guidance in the NIPP for documenting sources of
information when conducting risk assessments, the Pipeline Security
Branch should document the information used. Keeping the risk
assessment updated with current information, as well as documenting
those data sources, could help the Pipeline Security Branch ensure it
is using its limited resources to review the pipeline systems with
greater risk.
Vulnerability
Finally, another shortfall in the current pipeline risk assessment
methodology is that it does not account for natural hazards in its
threat calculation, even though DHS's definition of threat includes
natural hazards, and security and resilience of critical infrastructure
are often presented in the context of natural hazards.\3\ According to
the NIPP, threat is a natural or manmade occurrence, individual,
entity, or action that has or indicates the potential to harm life,
information, operations, the environment, and/or property. As such,
along with terrorism, criminal activity and cybersecurity, natural
disasters are a key element of DHS's critical infrastructure security
and resilience mission.
---------------------------------------------------------------------------
\3\ From the DHS Risk Lexicon, 2010 Edition, threat is a natural or
man-made occurrence, individual, entity, or action that has or
indicates the potential to harm life, information, operations, the
environment, and/or property. Presidential Policy Directive/PPD-21,
Critical Infrastructure Security and Resilience (Washington, D.C.: Feb.
12, 2013) also presents the security and resilience of critical
infrastructure in the context of natural hazards.
---------------------------------------------------------------------------
According to Pipeline Security Branch officials, there is not
sufficient historical data available that would indicate a significant
impact from natural disasters on specific pipeline systems. However, we
identified possible sources of data for the Pipeline Security Branch to
consider. For example, a 2016 RAND Corporation study examined national
infrastructure systems' exposure to natural hazards, including
pipelines.\4\ Additionally, the Federal Emergency Management Agency
(FEMA) has collaborated with stakeholders to develop the National Risk
Index to, among other things, establish a baseline of natural hazards
risk for the United States While there may not be historical data of
natural hazard impact for every pipeline system, consulting other
sources or experts could provide regional data or analysis to build a
more comprehensive threat picture to help distinguish threats by
pipeline system. According to the NIPP, hazard assessments should rely
not only on historical information, but also future predictions about
natural hazards to assess the likelihood or frequency of various
hazards.
---------------------------------------------------------------------------
\4\ Henry H. Willis et al., Current and Future Exposure of
Infrastructure in the United States to Natural Hazards. (Santa Monica,
Calif.: RAND Corporation, 2016), https://www.rand.org/pubs/
research_reports/RR1453.html.
---------------------------------------------------------------------------
We also identified multiple shortfalls in the vulnerability factors
used in the risk assessment methodology, such as the potential
uncertainty of the number of critical facilities and incorporating a
feedback mechanism to calculate overall risk reduction. Other
considerations for vulnerability calculations include physical
condition of the pipeline system, cybersecurity activities, and
interdependencies among sectors.
The number of critical facilities a pipeline system has identified
is used as an input for its vulnerability calculation in the Pipeline
Security Branch's risk assessment methodology. As discussed earlier, we
identified deficiencies in TSA's criteria for identifying critical
facilities, and found that well-defined criteria and consistent
application of the criteria for identifying critical facilities could
improve the results of the Pipeline Security Branch's risk assessment.
Nevertheless, communicating in the risk assessment the uncertainty that
may be inherent in this self-reported information would better align
the risk assessment with the NIPP.
Another shortfall in the risk assessment is its inability to
reliably measure the progress a pipeline system made in addressing
vulnerability gaps between security reviews. The current risk
assessment includes a CSR score as part of its vulnerability
calculation, which was developed in part in response to our 2010
recommendation to use more reliable data to measure a pipeline system's
vulnerability gap. However, during our review, Pipeline Security Branch
officials said they plan to remove pipeline companies' CSR scores from
the risk assessment calculations, because they and industry partners do
not have confidence that the score appropriately measures a pipeline
system's vulnerability. For example, Pipeline Security Branch officials
explained that pipeline companies consider security factors
differently, which can lead to variation in implementing risk reduction
activities and by extension lead to different CSR scores. However,
removing the CSR score eliminates the only feedback mechanism in the
risk assessment from a pipeline company's actual security review
conducted by the Pipeline Security Branch. The NIPP and DHS's Risk
Management fundamentals emphasize the important role that such feedback
mechanisms play in risk management. Officials from the Pipeline
Security Branch agree on the importance of a feedback mechanism tying
results of reviews to a revised vulnerability metric, but said they
need a better measure than the current CSR score which is unreliable
for comparative and analytic purposes. Developing a feedback mechanism
based on implementation of TSA's Pipeline Security Guidelines could be
an important input to the risk assessment's vulnerability calculation.
This information would also inform the amount of risk pipeline
companies are reducing by implementing the guidelines and could be used
to inform overall risk reduction.
The physical and cyber environments in which the pipeline sector
operates also present vulnerabilities not accounted for in the pipeline
risk assessment. In recent years, DHS has listed the potential for
catastrophic losses to dramatically increase the overall risk
associated with failing infrastructure and highlighted risks due to
climate change and natural hazards to pipelines.\5\ For example, DHS
reported extreme temperatures--such as higher and lower temperatures
over prolonged periods of time--increase vulnerability to the critical
infrastructure by causing elements to break and cease to function.
Pipelines that freeze and then rupture can affect the energy and
transportation systems sectors. As noted above, according to the NIPP,
a natural or man-made occurrence or action with the potential to harm
life is considered a threat, whereas vulnerability is defined as a
physical feature or operational attribute that renders an entity open
to exploitation or susceptible to a given threat or hazard. While
pipeline physical condition is typically thought of in context of
safety, pipeline condition or location (such as above or below ground)
could touch upon pipeline security as it relates to system
vulnerability. For example, a pipeline system or segment of a system
with a compromised physical condition due to corrosion or age could
affect the system's vulnerability to threats and affect its ability to
recover from such threats by potentially increasing the time a system
is offline.
---------------------------------------------------------------------------
\5\ The Department of Homeland Security, National Critical
Infrastructure Protection and Resilience Annual Report 2011-2012,
Washington, D.C., Aug. 2013.
---------------------------------------------------------------------------
According to the Transportation Systems Sector-Specific Plan,
vulnerabilities to damage in aging transportation infrastructure--of
which pipelines are a part--are projected to increase with the
continued effects of climate change. Further, according to TSA's
Pipeline Security and Incident Recovery Protocol Plan, pipeline
integrity efforts--including the design, construction, operation, and
maintenance of pipelines--are important to pipeline security because
well-maintained, safe pipelines are more likely to tolerate a physical
attack.\6\ The Pipeline Security Branch already collects information
from the Pipeline and Hazardous Materials Safety Administration (PHMSA)
for its risk assessment, specifically information on High Consequence
Area and High Threat Urban Area mileage.\7\ By considering additional
information PHMSA collects on pipeline integrity, the Pipeline Security
Branch could also use the information to help pipeline operators
identify security measures to help reduce the consequences related to
the comparatively higher vulnerability of an aging or compromised
system. This would align with the Pipeline Security Branch's efforts to
improve security preparedness of pipeline systems and could better
inform its vulnerability calculations for relative risk ranking of
pipeline systems.
---------------------------------------------------------------------------
\6\ Transportation Security Administration, Pipeline Security and
Incident Recovery Protocol Plan, March 2010.
\7\ PHMSA defines ``high consequence areas'' differently for gas
and hazardous liquid. For gas, high consequence areas typically include
highly populated or frequented areas, such as parks. See 49 C.F.R.
Sec. 192.903. For hazardous liquid, high consequence areas include
highly populated areas, other populated areas, navigable waterways, and
areas unusually sensitive to environmental damage. See 49 CFR
Sec. 195.450. TSA regulations pertaining to rail transportation
security define High Threat Urban Area as ``an area comprising one or
more cities and surrounding areas including a 10-mile buffer zone.''
See 49 C.F.R. Sec. 1580.3.
---------------------------------------------------------------------------
Capturing cybersecurity in the risk assessment is also an area for
improvement. Pipeline Security Branch officials told us they consulted
with the National Cybersecurity and Communications Integration Center
to revise TSA's Pipeline Security Guidelines to align with the National
Institute of Standards and Technology (NIST) Cybersecurity Framework
and that absent data specific to pipelines on their cybersecurity
vulnerabilities, they are unable to include a pipelines' vulnerability
to cyber attack in the risk assessment. However, the Pipeline Security
Branch recently updated the security review questions asked of pipeline
operators during corporate and critical facility reviews based on the
recently updated Pipeline Security Guidelines. Using these updated
questions related to companies' cybersecurity posture, the Pipeline
Security Branch could collect additional information on cybersecurity
vulnerabilities which could inform the risk assessment. This could be
an element of the feedback mechanism described above and emphasized in
the NIPP. Additionally, NIST identified several supply chain
vulnerabilities associated with cybersecurity, which are not currently
accounted for in TSA's Pipeline Security Guidelines.\8\ As pipeline
operators implement increasing levels of network technologies to
control their systems, the Pipeline Security Branch may not be fully
accounting for pipeline systems' cybersecurity posture by not including
the cybersecurity-related vulnerabilities in its risk assessment
inputs.
---------------------------------------------------------------------------
\8\ According to NIST's Supply Chain Risk Management Practices for
Federal Information Systems and Organizations, NIST Special Publication
800-161 (April 2015), there are three principal vulnerabilities to
identify: (1) Access paths within the supply chain that would allow
malicious actors to gain information about the system and ultimately
introduce components that could cause the system to fail at some later
time; (2) Access paths that would allow malicious actors to trigger a
component malfunction or failure during system operations; and (3)
Dependencies on supporting or associated components that might be more
accessible or easier for malicious actors to subvert than components
that directly perform critical functions.
---------------------------------------------------------------------------
Consequence
Finally, we identified shortfalls in cross-sector
interdependencies, which could affect vulnerability calculations.
According to the NIPP, understanding and addressing risks from cross-
sector dependencies and interdependencies is essential to enhancing
critical infrastructure security and resilience. The Pipeline Security
Branch's pipeline risk assessment currently considers the effects of a
pipeline system's ability to service assets such as major airports, the
electric grid, and military bases.
However, consequence is calculated on the loss or disruption of the
pipeline system to these other assets and does not capture the
dependency of the pipeline system on other energy sources, such as
electricity. Weather events such as Gulf of Mexico hurricanes and
Superstorm Sandy highlighted the interdependencies between the pipeline
and electrical sectors. Specifically, according to a 2015 DHS annual
report on critical infrastructure, power failures during Superstorm
Sandy in 2012 closed major pipelines for 4 days, reducing regional oil
supplies by 35 to 40 percent. The report goes on to say that the
interconnected nature of infrastructure systems can lead to cascading
impacts and are increasing in frequency.\9\ Pipeline Security Branch
officials are considering cross-sector interdependencies and said they
discuss these factors with operators as they relate to system
resiliency. Considering interdependencies of sectors in both
directions--such as calculating the likelihood that an input like
electricity could fail and cause disruptions to critical pipelines--
could improve the calculations in the pipeline risk assessment.
---------------------------------------------------------------------------
\9\ The DHS report highlighted this element of risk management
stating while sectors understand the direct impacts (i.e., loss of life
and economic consequences) from damaged or failing infrastructure, the
dependencies and interdependencies associated with related service
disruptions are not as well known.
---------------------------------------------------------------------------
As previously discussed, the Pipeline Security Branch last
calculated relative risk among the top 100 pipeline systems in 2014.
When doing so, it used pipeline systems' throughput data from 2010 to
assess relative risk. According to Pipeline Security Branch officials,
the amount of throughput in pipeline systems does not change
substantially year to year. However, Standards for Internal Control in
the Federal Government calls for management to use quality information
to achieve the entity's objectives, including using relevant data from
reliable sources obtained in a timely manner. The Pipeline Security
Branch uses throughput data as a consequence factor in the risk
assessment to determine a pipeline system's relative risk score.\10\
Throughput changes could affect relative risk ranking and the Pipeline
Security Branch's ability to accurately prioritize reviews based on
relative risk.
---------------------------------------------------------------------------
\10\ A pipeline system with higher throughput would be considered
to have a higher consequence score.
---------------------------------------------------------------------------
______
Appendix III: Comments from the Department of Homeland Security
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Appendix IV: GAO Contact and Staff Acknowledgments
GAO Contact
Staff Acknowledgments
Chris P. Currie at (404) 679-1875 or curriec@gao.gov
Nick Marinos at (202) 512-9342 or marinosn@gao.gov.
In addition to the contacts named above, Ben Atwater, Assistant
Director; Michael W. Gilmore, Assistant Director; and Michael C.
Lenington, Analyst-in-Charge, managed this assignment. Chuck Bausell,
David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A. Johnson,
Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and
Janay Sam made significant contributions to this report.
The Chairman. Imagine what might result if an attack on
Colonial Pipeline happened to an electric company. It wouldn't
just be some small drivers unable to fill up or forced to pay
at the pump. A grid disruption could have massive impacts to
our economy. Lives could also be on the line. It would take
months for the U.S. to recover from such a hostile attack in
the shutdown of our electricity grid.
Electric companies are now working overtime to protect
their system, but the Federal Government should be part of the
solution. We need to bring about critical infrastructure
investments in technology that can help the electricity grid
and companies secure their networks from these kinds of
intrusions.
For example, helping utilities install fiber optic
technologies to run their transmission lines, helping them to
create closed communication networks, using directed fiber
links for grid monitoring and control that will insulate the
electric grid from these kind of cyber attacks should be a
major priority for this Administration.
These investments could also serve as backbone for other
important communications systems throughout our rural
communities that aren't currently being served. It also can
help ensure the challenges that we face in some of our urban
areas.
So I appreciate the recent steps the Department of Homeland
Security has taken to bolster pipeline cyber-security and the
recent release of a second Security Directive.
While these Directives are an initial step in the right
direction, many of them are needed to ensure the security of
the Nation's pipeline. While TSA has taken steps to address the
weakness in overseeing the pipeline security, as I mentioned,
the GAO report shows incomplete information for security risk
assessments, age protocols for responding to security
incidents, and obviously many of the workforce issues that we
have previously addressed in this committee.
At one point TSA only had six individuals working on
Pipeline Security Group and that number has now grown to 34,
but they're covering 2.7 miles of pipeline and we need to
increase our accountability over this issue.
So I look forward to hearing what our witnesses have to say
about this very important issue of how we grow our security in
such a critical area of our Nation's economy.
I'll now turn to the Ranking Member, Senator Wicker.
STATEMENT OF HON. ROGER WICKER,
U.S. SENATOR FROM MISSISSIPPI
Senator Wicker. Thank you, Senator Cantwell.
On May 7th of this year, malicious attackers attacked
Colonial Pipeline's network and infected its computer system.
This was a major wake-up call for the United States and for us
as policymakers.
Colonial was temporarily forced to shut down its pipeline,
disrupting energy supplies running from Houston, Texas, to the
doorstep of New York City. As a result, we witnessed fuel and
gasoline shortages across the Southeast and the Mid-Atlantic.
The effect of this dramatic attack highlighted the very
present risks from cyber crime to our national security.
Today's hearing is an opportunity to discuss how to prepare
our critical infrastructure systems against emerging cyber
threats and how we can apply lessons learned from the Colonial
Pipeline incident.
Our nation has roughly three million miles of pipelines
transporting essential energy products across the United
States. Those energy products keep our businesses running, our
lights on, and our homes warm in the winter.
It is essential that this critical infrastructure be
protected against cyber attacks like the one on Colonial
Pipeline in May.
Having fuel supplies cutoff for extended periods of time is
devastating to Americans and to our economy. Senator Cantwell
has not overstated the problem or the risk.
I'm glad Administrator Pekoske is here today to help us
understand the Transportation Security Administration's leading
role in overseeing our pipeline cybersecurity. I appreciate
TSA's ongoing efforts to enhance Federal pipeline cybersecurity
programs to address growing cyber-security risks.
This has long been a priority for me and this committee.
Last Congress I worked with Senator Cantwell on legislation to
grow our cybersecurity workforce so that American companies and
government agencies have the talent to protect their systems
from criminals.
As the Federal Government considers ways to improve the
cybersecurity framework of the pipeline sector, it will be
increasingly important for the public and private sectors to
coordinate their efforts more closely.
The vast majority of the Nation's critical infrastructure
is owned and operated by the private sector. Utilizing the
expertise of operators and the relevant safety regulators will
lead to a more successful implementation of Security Directives
from TSA.
Because cyber crimes and the technologies used to conduct
these attacks are continuing to evolve, we should avoid a one-
size-fits-all approach and ensure that Federal policy provides
flexibility of response and adequately accounts for changing
risks.
We need to ensure pipelines continue to be a safe means of
product transportation and can operate without disruption,
which is a top priority for this committee. Strong public/
private partnerships are critical in protecting the Nation
against attacks from state actors, such as China and Russia.
Coordination between government and industry is needed to
improve information-sharing about emerging cyber threats and
best practices to address them. Industry should also build
strong relationships with their regulators and law enforcement
to increase that collaboration.
No company should stand alone in the face of threats from
countries that want to do us harm. Just the other day the Biden
Administration publicly condemned the People's Republic of
China for its cybersecurity campaigns. I appreciate that
statement, but more action is needed to push back on threats
from China and hold Beijing accountable for its malicious
behavior.
I want to thank all our witnesses for being here today and
I look forward to your testimony and our give and take during
question and answer.
Thank you, ma'am.
The Chairman. Thank you, Senator Wicker, for those
comments.
I also wanted to enter into the record a couple of
articles, one by David Sanger of the New York Times: Pipeline
Attacks Yields Urgent Lessons About the White House
Cybersecurity, just one paragraph there.
``The bad news is they say was that American adversaries,
not only super powers but terrorists and cyber criminals,
learned just how little it takes to incite chaos across a large
part of the country, even if they don't break into the core of
the electricity grid.''
So I want to enter that and an article by United Divide:
Colonial Pipeline Hack Highlights Grid's Disruption Even with
IT Focus, Cyber Attacks and Colonial Pipeline Cyber Attacks
Highlights Need for More Serious Energy Policy.
So we'll enter those into the record.
[The information referred to follows:]
New York Times | https://www.nytimes.com/2021/05/14/us/politics/
pipeline-hack.html
Pipeline Attack Yields Urgent Lessons About U.S. Cybersecurity
The hack underscored how vulnerable government and industry are to even
basic assaults on computer networks.
By David E. Sanger and Nicole Perlroth
Published May 14, 2021 Updated June 8, 2021
For years, government officials and industry executives have run
elaborate simulations of a targeted cyberattack on the power grid or
gas pipelines in the United States, imagining how the country would
respond.
But when the real, this-is-not-a-drill moment arrived, it didn't
look anything like the war games.
The attacker was not a terror group or a hostile state like Russia,
China or Iran, as had been assumed in the simulations. It was a
criminal extortion ring. The goal was not to disrupt the economy by
taking a pipeline offline but to hold corporate data for ransom.
The most visible effects--long lines of nervous motorists at gas
stations--stemmed not from a government response but from a decision by
the victim, Colonial Pipeline, which controls nearly half the gasoline,
jet fuel and diesel flowing along the East Coast, to turn off the
spigot. It did so out of concern that the malware that had infected its
back-office functions could make it difficult to bill for fuel
delivered along the pipeline or even spread into the pipeline's
operating system.
What happened next was a vivid example of the difference between
tabletop simulations and the cascade of consequences that can follow
even a relatively unsophisticated attack. The aftereffects of the
episode are still playing out, but some of the lessons are already
clear, and demonstrate how far the government and private industry have
to go in preventing and dealing with cyberattacks and in creating rapid
backup systems for when critical infrastructure goes down.
In this case, the long-held belief that the pipeline's operations
were totally isolated from the data systems that were locked up by
DarkSide, a ransomware gang believed to be operating out of Russia,
turned out to be false. And the company's decision to turn off the
pipeline touched off a series of dominoes including panic buying at the
pumps and a quiet fear inside the government that the damage could
spread quickly.
A confidential assessment prepared by the Energy and Homeland
Security Departments found that the country could only afford another
three to five days with the Colonial pipeline shut down before buses
and other mass transit would have to limit operations because of a lack
of diesel fuel. Chemical factories and refinery operations would also
shut down because there would be no way to distribute what they
produced, the report said.
And while President Biden's aides announced efforts to find
alternative ways to haul gasoline and jet fuel up the East Coast, none
were immediately in place. There was a shortage of truck drivers, and
of tanker cars for trains.
``Every fragility was exposed,'' Dmitri Alperovitch, a co-founder
of CrowdStrike, a cybersecurity firm, and now chairman of the think
tank Silverado Policy Accelerator. ``We learned a lot about what could
go wrong. Unfortunately, so did our adversaries.''
The list of lessons is long. Colonial, a private company, may have
thought it had an impermeable wall of protections, but it was easily
breached. Even after it paid the extortionists nearly $5 million in
digital currency to recover its data, the company found that the
process of decrypting its data and turning the pipeline back on again
was agonizingly slow, meaning it will still be days before the East
Coast gets back to normal.
``This is not like flicking on a light switch,'' Mr. Biden said
Thursday, noting that the 5,500-mile pipeline had never before been
shut down.
For the administration, the event proved a perilous week in crisis
management. Mr. Biden told aides, one recalled, that nothing could
wreak political damage faster than television images of gas lines and
rising prices, with the inevitable comparison to Jimmy Carter's worse
moments as president.
Mr. Biden feared that, unless the pipeline resumed operations,
panic receded and price gouging was nipped in the bud, the situation
would feed concerns that the economic recovery is still fragile and
that inflation is rising.
Beyond the flurry of actions to get oil moving on trucks, trains
and ships, Mr. Biden published a long-gestating executive order that,
for the first time, seeks to mandate changes in cybersecurity.
And he suggested that he was willing to take steps that the Obama
administration hesitated to take during the 2016 election hacks--direct
action to strike back at the attackers.
``We're also going to pursue a measure to disrupt their ability to
operate,'' Mr. Biden said, a line that seemed to hint that United
States Cyber Command, the military's cyberwarfare force, was being
authorized to kick DarkSide off line, much as it did to another
ransomware group in the fall ahead of the presidential election.
Hours later, the group's Internet sites went dark. By early Friday,
DarkSide, and several other ransomware groups, including Babuk, which
has hacked Washington D.C.'s police department, announced they were
getting out of the game.
DarkSide alluded to disruptive action by an unspecified law
enforcement agency, though it was not clear if that was the result of
U.S. action or pressure from Russia ahead of Mr. Biden's expected
summit with President Vladimir V. Putin. And going quiet might simply
have reflected a decision by the ransomware gang to frustrate
retaliation efforts by shutting down its operations, perhaps
temporarily.
The Pentagon's Cyber Command referred questions to the National
Security Council, which declined to comment.
The episode underscored the emergence of a new ``blended threat,''
one that may come from cybercriminals, but is often tolerated, and
sometimes encouraged, by a nation that sees the attacks as serving its
interests. That is why Mr. Biden singled out Russia--not as the
culprit, but as the Nation that harbors more ransomware groups than any
other country.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
President Biden made clear that he was willing to take action to
disrupt or shut down the criminal network behind the extortion. T.J.
Kirkpatrick for The New York Times
``We do not believe the Russian government was involved in this
attack, but we do have strong reason to believe the criminals who did
this attack are living in Russia,'' Mr. Biden said. ``We have been in
direct communication with Moscow about the imperative for responsible
countries to take action against these ransomware networks.''
With DarkSide's systems down, it is unclear how Mr. Biden's
administration would retaliate further, beyond possible indictments and
sanctions, which have not deterred Russian cybercriminals before.
Striking back with a cyberattack also carries its own risks of
escalation.
The administration also has to reckon with the fact that so much of
America's critical infrastructure is owned and operated by the private
sector and remains ripe for attack.
``This attack has exposed just how poor our resilience is,'' said
Kiersten E. Todt, the managing director of the nonprofit Cyber
Readiness Institute. ``We are overthinking the threat, when we're still
not doing the bare basics to secure our critical infrastructure.''
The good news, some officials said, was that Americans got a wake-
up call. Congress came face-to-face with the reality that the Federal
government lacks the authority to require the companies that control
more than 80 percent of the Nation's critical infrastructure adopt
minimal levels of cybersecurity.
The bad news, they said, was that American adversaries--not only
superpowers but terrorists and cybercriminals--learned just how little
it takes to incite chaos across a large part of the country, even if
they do not break into the core of the electric grid, or the
operational control systems that move gasoline, water and propane
around the country.
Something as basic as a well-designed ransomware attack may easily
do the trick, while offering plausible deniability to states like
Russia, China and Iran that often tap outsiders for sensitive
cyberoperations.
It remains a mystery how DarkSide first broke into Colonial's
business network. The privately held company has said virtually nothing
about how the attack unfolded, at least in public. It waited four days
before having any substantive discussions with the administration, an
eternity during a cyberattack.
Cybersecurity experts also note that Colonial Pipeline would never
have had to shut down its pipeline if it had more confidence in the
separation between its business network and pipeline operations.
``There should absolutely be separation between data management and
the actual operational technology,'' Ms. Todt said. ``Not doing the
basics is frankly inexcusable for a company that carries 45 percent of
gas to the East Coast.''
Other pipeline operators in the United States deploy advanced
firewalls between their data and their operations that only allow data
to flow one direction, out of the pipeline, and would prevent a
ransomware attack from spreading in.
Colonial Pipeline has not said whether it deployed that level of
security on its pipeline. Industry analysts say many critical
infrastructure operators say installing such unidirectional gateways
along a 5,500-mile pipeline can be complicated or prohibitively
expensive. Others say the cost to deploy those safeguards are still
cheaper than the losses from potential downtime.
Deterring ransomware criminals, which have been growing in number
and brazenness over the past few years, will certainly be more
difficult than deterring nations. But this week made the urgency clear.
``It's all fun and games when we are stealing each other's money,''
said Sue Gordon, a former principal deputy director of national
intelligence, and a longtime C.I.A. analyst with a specialty in
cyberissues, said at a conference held by The Cipher Brief, an online
intelligence newsletter. ``When we are messing with a society's ability
to operate, we can't tolerate it.''
______
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
The Chairman. So welcome to our witnesses. We have the
Honorable David Pekoske, Administrator of the TSA. Welcome.
Thank you for being here.
The Honorable Polly Trottenberg, Deputy Secretary of
Transportation. Thank you for being here.
And Ms. Leslie Gordon, Acting Director of Homeland
Security, Justice, Government Accountability Office, in
Washington, D.C.
So welcome to all the witnesses.
Mr. Pekoske, Administrator Pekoske, we'll start with you.
Again look forward to your testimony.
STATEMENT OF HON. DAVID P. PEKOSKE, ADMINISTRATOR,
TRANSPORTATION SECURITY ADMINISTRATION
Mr. Pekoske. Thank you, Chair Cantwell, Ranking Member
Wicker, appreciate the opportunity to appear before you this
morning, and I'm honored to testify alongside two distinguished
government leaders: Deputy Secretary Polly Trottenberg and
Acting GAO Director Leslie Gordon.
As I begin my testimony, I want to highlight the hard work
and professionalism of the TSA workforce who continue to
safeguard our transportation system, both aviation and surface,
during this pandemic, and are meeting the challenge of
providing security each day as millions of passengers return to
travel this summer.
I appreciate the Committee's focus and their long-time
priority on surface transportation security. Since the
enactment of the TSA Modernization Act of 2018, we have
substantially increased the number of people directly
supporting the surface transportation security mission.
At Headquarters, we have a new Office of Surface Operations
that is led by a member of the Senior Executive Service. We
have a specific Pipeline Security Staff that has increased over
sixfold to 39 FTEs and approximately 20 cyber positions in this
office.
In the field, we now have five regional security directors,
each with a staff of five, who have mission solely focused on
surface transportation security. Supporting the regional
security directors are 200 surface transportation security
inspectors at 47 locations across the country.
Additionally, this committee authorized the Surface
Transportation Security Advisory Committee or STSAC that
provides the same strong advocacy function that the Aviation
Security Advisory Committee has provided the aviation sector.
This new advisory committee is off to an impressive start and,
in addition to the Surface System Owners and Operators who are
members, the STSAC includes membership from all the DOT Surface
Modal Administrations, to include the Pipeline and Hazardous
Materials Safety Administration, the Department of Energy, and
two DHS components, CISA and the Coast Guard.
The threats to pipelines have been increasing as evidenced
by a Joint Cybersecurity Advisory issued just last week by CISA
and the FBI. This advisory provides information on a spear
phishing and intrusion campaign by state-sponsored Chinese
actors in late 2011 and early 2012.
CISA and FBI assessed that this activity was ultimately
intended to help China develop cyber attack capabilities
against U.S. pipelines, to physically damage pipelines or
disrupt pipeline operations.
While the advisory is just being made public, indicators of
compromise were provided in 2012 to the affected companies and
the pipeline industry stakeholders.
Recognizing the risk to pipelines, the TSA issued Pipeline
Security Guidelines in 2011. The latest version was published
in March 2018 and updated in April of this year.
These guidelines were collaboratively developed with
industry and government partners and they were operationalized
through voluntary corporate security reviews, critical facility
security reviews, and validated architecture design reviews.
More than 80 percent of the most critical pipeline companies
have completed at least one of these reviews.
However, based on additional more recent intelligence
information and the ransomware attack on the Colonial Pipeline
in May, TSA, in full coordination with our interagency
partners, has issued two Security Directives to meet this
immediate security threat, reduce the vulnerability of our
pipeline system, and immediately protect transportation
security.
The first Security Directive was issued on the 28th of May.
The contents of this Security Directive are not sensitive
security information. It required critical pipeline owners and
operators who represent 85 percent of the energy product moved
by pipelines to report significant cyber incidents to CISA, to
designate a cybersecurity coordinator available 24/7, and to
review current activities against our guidelines on
cybersecurity. We have a hundred percent response from the
affected pipeline companies.
The second Security Directive was issued last Monday for
the same companies as the first and it became effective
yesterday. The contents of this second Security Directive are
sensitive security information.
We used NIST Special Publications and the NIST
Cybersecurity Framework in developing our directive. These are
proven and tested cybersecurity best practices. They require
specific mitigation measures, a comprehensive cybersecurity
contingency and response plan, and cybersecurity architecture
design and reviews.
It provides for submission and the accelerated review of
alternate procedures and this Directive was developed in
coordination with our interagency partners and with input from
the affected pipeline companies and associations in advance.
I appreciate the thorough reviews GAO has conducted on
pipeline security. They've issued two reports, one in December
2018 and one in June 2019. We have closed 12 of the 15
recommendations that GAO made which we concurred with, three
remain open. I expect all three will be complete as soon as
possible and thank GAO for the review and advice.
In closing, we are dedicated to protecting our Nation's
pipelines and cooperation and collaboration with our government
and private sector partners.
Thank you for your strong support of TSA and for the
opportunity to testify this morning. I look forward to your
questions. Thank you.
[The prepared statement of Mr. Pekoske follows:]
Prepared Statement of Hon. David P. Pekoske, Administrator,
Transportation Security Administration,
U.S. Department of Homeland Security
Good morning, Chair Cantwell, Ranking Member Wicker, and
distinguished Members of the Committee. I appreciate the opportunity to
appear before you today to discuss the Transportation Security
Administration's (TSA) role in pipeline security.
The nation's pipeline systems illustrate how vital critical
pipeline systems are to the economy, our national security, and the
livelihood of our country. Safeguarding these systems is a critical
undertaking and requires extensive collaboration with pipeline owners
and operators. The United States has more than 2.8 million miles of
natural gas and hazardous liquid pipelines owned and operated by over
3,000 private companies. In addition to the pipelines themselves, the
systems include critical facilities such as compressor and pumping
stations, metering and regulator stations, interconnects, main line
valves, tank farms and terminals, and automated systems used to monitor
and control these facilities. Pipelines are susceptible to physical
attacks and other acts of tampering and sabotage. Cyber intrusions into
pipeline computer networks have the potential to negatively impact our
national security, economy, commerce, and well-being.
Pipeline Staffing, Resourcing, and Expanding Internal Capabilities
To support the surface transportation security mission, TSA has
developed surface transportation policies and regulations; supports the
grant process for surface transportation-related security enhancements;
conducts inspections and assessments of surface transportation
operators to identify risk and provide risk mitigation strategies; and
provides workforce training and exercise support. In response to the
TSA Modernization Act, in October 2019, TSA established the Surface
Operations office, which reports to the Executive Assistant
Administrator for Security Operations. This organization is led by an
Assistant Administrator and Deputy Assistant Administrator, both
members of the Senior Executive Service, at TSA Headquarters, and five
Regional Security Directors in the field, all at the Senior Executive
Service level. The Regional Security Directors and their supporting
staff have direct operational oversight of approximately 200 Surface
Transportation Security Inspectors deployed in 47 field offices across
the country. Since the passage of the TSA Modernization Act, TSA has
expanded our pipeline security staff from six to 39 Full Time
Equivalents (FTEs) working in field operations, headquarters
operations, and policy development. These resources, both in our
headquarters and in the field have allowed us to substantially increase
our surface transportation security capability.
Further, in Fiscal Year (FY) 2020, TSA established and trained a
20-member field-based Pipeline Security Assessment Team (PSAT), which
is comprised of credentialed Transportation Security Inspectors (TSIs)
located around the Nation in order to expand TSA's support and
engagement capacity with pipeline owners and operators. For
cybersecurity efforts, we now have eight members from the PSAT team and
TSA headquarters who completed comprehensive cybersecurity training,
provided by Idaho National Labs. This was done in partnership with the
Department of Homeland Security's (DHS) Cybersecurity and
Infrastructure Security Agency (CISA), and we are receiving additional
cybersecurity certification in support of TSA's pipeline security
mission.
TSA continues to expand its cybersecurity staffing and resourcing
capabilities through the establishment of a Cybersecurity Operations
Support Branch embedded within Surface Operations. As part of the 39
FTE previously mentioned, staffing for this Cyber Branch will include
an additional 10 specialized cybersecurity personnel, all of whom are
expected to be onboard in the next 60 days. This increase is a direct
result of the Cyber Workforce Initiative implemented by DHS this year
that allows direct hiring for individuals with the appropriate
cybersecurity expertise. In addition to these newly hired cybersecurity
experts, TSA has positioned additional field-based TSIs to undergo
cybersecurity training and are on a career path to become cyber
assessors within the surface transportation environment. This newly
established field-based team will create an additional capability for
local level cybersecurity outreach and establish a model for future
professional cybersecurity career progression within TSA.
We will continue to evaluate and support implementation of
cybersecurity best practices across the transportation sector and
collaborate with other government agencies on surface cyber programs
and engagements.
The TSA Surface Policy Division within the Policy, Plans, and
Engagement office, in Operations Support, is also increasing its
cybersecurity efforts and will expand its workforce specializing in
cybersecurity from six positions to a total of nine within the next 60
days. This resource will focus on the development of cybersecurity-
related policy and guidance for surface transportation security.
Stakeholder Partnership
In 2003, TSA began assessing the state of security in the pipeline
industry through its Corporate Security Review (CSR) program. The goals
of the program were to develop first-hand knowledge of the security
measures in place at critical pipeline sites and establish working
relationships with key pipeline security personnel including the
industry-established Oil and Natural Gas Sector Coordinating Council
(ONG SCC). The initial CSRs identified smart security practices and
laid the groundwork for TSA's Pipeline Security Guidelines. The
Pipeline Security Guidelines, required by the Implementing
Recommendations of the 9/11 Commission Act of 2007, went into effect in
2011 and with a 2018 revision, are still in use today and updated as
necessary.
These Pipeline Security Guidelines provide a security structure for
pipeline owners and operators to use in developing their security plans
and programs and contain recommended security measures for both
physical and cyber security that serve as the de facto industry
standard. The Pipeline Security Guidelines were updated and republished
in March 2018 with a significant emphasis on cybersecurity measures
that are aligned with the National Institute of Standards and
Technology (NIST) Cyber Security Framework. The guideline's
cybersecurity measures were developed in coordination with industry and
with Industrial Control System (ICS) expertise from CISA. In April of
this year, the criteria for identifying critical pipeline facilities in
the guidelines were further updated.
Through our efforts to expand pipeline security, we have focused on
enhancing the security preparedness of the Nation's hazardous liquid
and natural gas pipeline system. TSA has established a range of
productive public-private partnerships to protect the transport of
hazardous liquids and natural gas. This partnership includes
collaboration with our Federal partners, such as CISA, the Department
of Transportation (DOT), the Department of Energy, and the Department
of Justice. We are also partnering with the Federal Energy Regulatory
Commission through the Energy Government Coordinating Council (EGCC).
In addition, TSA is providing input and support to the activities and
initiatives of the ONG SCC and the Pipeline Working Group (PWG), which
also serves as the Pipeline Subsector Coordinating Council (PSCC) of
the Transportation Systems Sector.
To support pipeline owners and operators in securing their systems,
TSA develops and regularly distributes security training materials for
industry employees and partners to increase domain awareness and ensure
security expertise is widely shared. These include a security awareness
training program highlighting signs of terrorism and each employee's
role in reporting suspicious activity, an IED awareness video for
employees, and an introduction to pipeline security for law enforcement
officers. To address cyber threats, the training materials, available
since 2017, contain a cybersecurity toolkit for small and midsize
businesses, offering guidance on how to incorporate cyber risk into
their transportation system. Also included is a pocket-sized guide for
frontline employees that outlines the most common types of
cybersecurity threats and explains how transportation systems can
protect their data, computer systems, and personal information.
Exercises, Assessments, and Site Reviews
TSA works with industry partners to assess and mitigate
vulnerabilities and improve security through collaborative efforts
including intelligence briefings, exercises, assessments, and on-site
reviews. Through the Intermodal Security Training and Exercise Program
(I-STEP), TSA provides the pipeline community with exercises, training,
and security planning tools to strengthen company security plans,
policies, and procedures. To date, TSA has conducted 21 ISTEP tabletop
exercises specific to pipelines, with pipeline companies participating
in numerous other exercises more broadly focused on all modes of
transportation. Working with pipeline operators' security personnel,
TSA conducts Pipeline CSRs, which assess the degree to which the
Pipeline Security Guidelines' physical and cybersecurity measures are
integrated into the operator's corporate security plan.
TSA also conducts Critical Facility Security Reviews on critical
pipeline facilities for the most critical pipeline owners and operators
to collect site-specific information on facility security policies,
procedures, and physical security measures.
TSA is a partner with CISA's National Risk Management Center in the
Pipeline Cybersecurity Initiative (PCI). The initiative was launched in
2018 to assist pipeline owners and operators to prepare for and respond
to significant cyber events. Through the PCI initiative CISA, TSA, and
Idaho National Laboratory assess the cybersecurity posture and
preparedness of pipeline companies, analyze assessment findings to
develop risk mitigation strategies and identify support and
informational tools that companies may use to address identified risks.
To promote a secure and resilient cybersecurity posture, TSA works
directly with CISA to collaborate with pipeline owners and operators to
offer cybersecurity architecture design reviews to assess a pipeline
operator's critical infrastructure including information technology
(IT) and operational technology (OT) systems. This assessment is
intended to determine if OT systems are designed, built, and operated
in a reliable, secure, and resilient manner. This assessment goes
beyond a questionnaire-type assessment and includes traffic analysis
from selected critical network segments. Pipeline owners and operators
have expressed appreciation for these reviews over the years,
understanding the value of identifying vulnerabilities to help better
secure their physical and cyber systems.
Cybersecurity
On behalf of DHS, the Co-Sector Risk Management Agency for the
Transportation Systems Sector (TSS) along with DOT, TSA serves as the
executive agent with the U.S. Coast Guard for TSS and is responsible
for developing, deploying, and promoting TSS-focused cybersecurity
initiatives, programs, assessment tools, strategies, and threat and
intelligence information-sharing products. TSA is in close alignment
with CISA and coordinates on both a tactical and strategic level to
raise the cybersecurity baseline across the transportation sector. As
noted earlier, TSA participates in the EGCC and regularly collaborates
with the ONG SCC and the PWG/PSCC on programmatic issues affecting the
cybersecurity of pipeline systems.
TSA also supports DHS's cybersecurity efforts in alignment with the
NIST Cybersecurity Framework (Framework). The Framework is designed to
provide a foundation for industry to better manage and reduce their
cyber risk. TSA shares information and resources and develops products
for stakeholders to support their adoption of the Framework. TSA works
closely with the pipeline industry to identify and reduce cybersecurity
vulnerabilities, including facilitating classified briefings to
increase industry's awareness of cyber threats.
Colonial Pipeline Incident
On May 7, 2021, the Colonial Pipeline Company announced it halted
its pipeline operations due to a ransomware attack. This incident
temporarily disrupted critical supplies of gasoline and other refined
petroleum products throughout the East Coast. This was not the first
cyber intrusion in our Nation to have a direct impact and cybersecurity
incidents affecting surface transportation systems continue to be a
growing and evolving threat.
In response to this cyber intrusion, TSA exercised its Aviation and
Transportation Security Act of 2001 authorities to strengthen the
cybersecurity and resilience of pipeline owners and operators by
issuing two Security Directives. The first Security Directive issued by
TSA following the Colonial Pipeline incident requires pipeline owners
and operators of critical hazardous liquid and natural gas pipelines or
a liquefied natural gas pipeline facility to designate a Cybersecurity
Coordinator who is required to be available to TSA 24/7 to coordinate
cybersecurity practices and address any incidents that arise. The
Cybersecurity Coordinator is also required to report significant
cybersecurity incidents to CISA and assess their current cybersecurity
posture against a specific set of measures within the Pipeline Security
Guidelines. As part of this assessment, the owners and operators must
identify any gaps, develop a remediation plan if necessary, and report
the results to TSA and CISA.
All information reported to CISA pursuant to the Security Directive
is securely shared with TSA and other Federal agencies as appropriate.
Similarly, all information provided to TSA is securely shared with CISA
and other Federal agencies as appropriate. By requiring the reporting
of significant cybersecurity incidents, the Federal government is
better positioned to understand the constantly changing threat of cyber
events and the current and evolving risks to pipelines. The designation
of Cybersecurity Coordinators will give TSA a known and consistent
point of contact with critical pipeline owners and operators, allowing
TSA to rapidly share security information and intelligence. The
assessments will assist owners and operators and TSA to better
understand the current state of cybersecurity practices in individual
companies and across the industry.
TSA is pleased to report that all of the designated owner/operators
have complied with requirements in the first Security Directive,
including conducting a self-assessment within 30 days, naming a
Cybersecurity Coordinator, and informing TSA of the designated
individual and alternate(s). This is a testament to the long-standing
security partnership developed over the years between TSA and this
critical sector and industry's commitment to fulfill their required
security responsibilities and take action on this evolving threat. TSA,
in partnership with CISA, is in the process of analyzing all
assessments to identify further mitigation efforts.
In response to the ongoing cybersecurity threat to pipeline
systems, on July 19, 2021, TSA issued a second Security Directive that
requires owners and operators of TSA-designated critical pipelines that
transport hazardous liquids and natural gas to implement a number of
urgently needed protections against cyber intrusions.
The second Security Directive was developed in close coordination
with Federal partners, including subject matter experts from CISA. TSA
consulted with industry on the Security Directive and took their
comments into consideration, including updating the security directive
to incorporate some of the feedback received. The second Security
Directive requires owners and operators of TSA-designated critical
pipelines to implement specific mitigation measures to protect against
ransomware attacks and other known threats to information technology
and operational technology systems, develop and implement a
cybersecurity contingency and recovery plan, and conduct a
cybersecurity architecture design review.
Conclusion
The pipeline system is crucial to U.S. national security,
transportation, and our energy supply. These pipelines provide
connections to other critical infrastructure upon which we depend, such
as power plants and the aviation gasoline fuel supply for airplanes.
TSA is dedicated to protecting our Nation's pipeline networks against
evolving threats and continues to work collaboratively with our
government and private partners to expand the implementation of
intelligence-driven, risk-based policies and programs. TSA is committed
to ensuring appropriate security measures are in place to increase the
physical and cyber security posture of the natural gas and hazardous
pipeline industry sub-sector in alignment with the risks this system
faces. Thank you for the opportunity to discuss TSA's efforts to
strengthen pipeline security, and I look forward to your questions.
The Chairman. Thank you, Administrator.
Deputy Secretary Trottenberg, thank you so much for being
here.
STATEMENT OF HON. POLLY TROTTENBERG, DEPUTY SECRETARY,
DEPARTMENT OF TRANSPORTATION
MS. TROTTENBERG: Thanks, Chair Cantwell, Ranking Member
Wicker, and Members of the Committee, for the opportunity to
testify this morning and for your support of the Department of
Transportation.
I'm honored to be here with my colleagues, Administrator
Pekoske and Acting Director Gordon, to discuss the security of
our Nation's pipeline system.
In recent years advances in hardware, software, and
computational capabilities have brought safety and efficiency
benefits to our pipeline system. However, as we're discussing
today, these advances are also introducing new cybersecurity
risks.
We're facing persistent and increasingly sophisticated
cyber attacks with serious consequences for our economy and our
communities. These risks require proactive, coordinated, and
agile responses.
Today I'll speak about DOT's role in pipeline and
transportation cybersecurity, our collaboration with the
Department of Homeland Security, other agencies, and the
private sector, and some lessons learned from our response to
the Colonial Pipeline attack.
DOT has different levels of responsibility over cyber-
security, depending on the mode of transportation, the level of
public versus private ownership, and the authorities of our
sister agencies. DOT's Pipeline and Hazardous Materials Safety
Administration, PHMSA, oversees the safe operation of nearly
three million miles of pipelines, 17,000 underground storage
tanks, more than a 160 liquefied natural gas facilities, and
1.2 million daily shipments of hazardous materials. PHMSA has
over 550 employees and a budget of $288 million.
With respect to cybersecurity, PHMSA's leveraging its
authorities in three critical areas: pipeline control room
regulations, the nerve centers of pipeline system operations,
integrity management plan requirements, and emergency response
plan regulations.
PHMSA coordinates closely with DHS in the regulation of
pipelines, particularly through its relationship with TSA as
delineated in our most recent Memorandum of Understanding which
promotes cooperation, communications, and non-duplication of
efforts.
More broadly, my written testimony details other offices
across DOT that work together to coordinate and manage
cybersecurity risks, including implementing President Biden's
Executive Order on Improving the Nation's Cybersecurity, as
well as our work with TSA, CISA, and private sector
stakeholders.
When the Colonial Pipeline cyber attack occurred on May
7th, President Biden directed a whole of government response.
Under the leadership of Secretary Buttigieg, PHMSA engaged
around the clock, collaborating with the pipeline company and
monitoring the safety of the pipeline.
PHMSA worked closely with Colonial to manually restart and
operate the pipeline which was unprecedented in the modern era
and to move nearly a million barrels of fuel within days.
DOT also acted quickly through FMCSA, MARAD, and other
agency partners to facilitate the transport of fuel by trucks
and ships to affected areas.
I'd like to take a moment to thank the DOT team for their
hard work during the Colonial Pipeline cyber attack and for all
they do to keep our transportation system safe and secure.
Traditionally PHMSA regulates safe pipeline operations and
TSA regulates cybersecurity, but the Colonial Pipeline cyber
attack illustrates how these two missions intertwine, requiring
collective action from different government agencies and the
private sector.
Therefore, PHMSA is revisiting the Scope of Integrity
Management Plan and Emergency Response Plan requirements for
pipeline operators to ensure they account for cyber-security
attack contingency.
PHMSA also continues to work closely with DHS and Federal
partners and shares information we receive through our
inspections.
The Colonial Pipeline cyber attack taught us many lesions,
particularly the need for trusted and timely information-
sharing as well as public and private sector partnership. It
also underscored that we need to keep learning and adapting
quickly to meet the increasingly complex and sophisticated
cybersecurity challenges.
At DOT, we look forward to working with this committee, our
sister agencies, and White House partners, as well as private
sector stakeholders, to strengthen and protect our Nation's
infrastructure.
Thank you again for the opportunity to testify and I look
forward to your questions.
[The prepared statement of Ms. Trottenberg follows:]
Prepared Statement of Hon. Polly Trottenberg, Deputy Secretary,
U.S. Department of Transportation
Chair Cantwell, Ranking Member Wicker, and Members of the
Committee, thank you for the opportunity to testify before you today,
and for your support of the Department of Transportation (DOT). I am
honored to be here with TSA Administrator Pekoske to discuss the
security of our Nation's pipeline system.
The nexus between transportation infrastructure and national
security centers on global competitiveness, climate change, and
cybersecurity. As a nation, we need to take all three seriously. Today
we will focus on the cybersecurity of a critical component of our
national infrastructure: the pipelines that help to fuel and power our
homes, our businesses, and our cars, trucks, and airplanes.
I. Cybersecurity Risks that Threaten Transportation Safety
In recent years, advances in hardware, software, and computational
capabilities have brought significant safety and efficiency benefits to
our pipeline system. However, these advances, along with the merging of
digital and physical systems and the increased reliance on data, are
introducing new cybersecurity risks to the integrity and availability
of pipeline operations. We face persistent and increasingly
sophisticated cyber attacks. And the Colonial Pipeline ransomware
attack starkly demonstrated how serious the consequences could be for a
key part of our national economy and all the Americans who rely on it.
These risks require proactive, coordinated, and agile responses.
Today, I will speak with you about DOT's role in pipeline and
transportation cybersecurity; our collaboration with the Department of
Homeland Security's (DHS's) Transportation Security Administration
(TSA) and Cybersecurity and Infrastructure Security Agency (CISA),
Department of Energy, which was the designated lead for the Colonial
response, other agencies, and the private sector; and the lessons
learned from our response to the Colonial attack.
II. DOT's Role and Modal Authorities
Depending on the mode of transportation, the level of public versus
private ownership, and the authorities of our interagency partners, the
Department of Transportation has different levels of authorities and
responsibilities over cybersecurity.
DOT's Pipeline and Hazardous Materials Safety Administration (or
``PHMSA'') oversees pipeline safety. PHMSA protects the American people
and the environment with the safe operation of nearly 3 million miles
of pipelines, 17,000 underground storage tanks, and more than 160
Liquefied Natural Gas facilities, as well as the safe packaging and 1.2
million daily shipments of hazardous materials. Pipelines, the vast
majority of which fall under private ownership, are a critical
component of our energy transportation infrastructure and quite
literally power the U.S. economy.
PHMSA has over 550 employees and a budget of $288M. With respect to
cybersecurity, PHMSA is pursuing the means to leverage its authorities
to inspect and enforce three critical components of pipeline
operations:
Pipeline control room regulations, which are the ``nerve
centers'' of pipeline system operations;
Integrity management plan requirements; and
Emergency response plan regulations.
Through these authorities, PHMSA regulates-and will regulate--at
the nexus between safe pipeline operations and cybersecurity. We
coordinate closely with DHS in the regulation of pipelines,
particularly through the relationship between the Transportation
Security Administration and PHMSA. A Memorandum of Understanding
recently updated as directed by Congress in the TSA Modernization Act
of 2018 delineates the roles and responsibilities of PHMSA and TSA
regarding the regulation of pipelines. The MOU promotes communications,
efficiency, and a non-duplication of efforts between PHMSA and TSA.
More broadly, many offices across DOT work together to manage
cybersecurity risks across our transportation system. Our Office of
Intelligence, Security, and Emergency Response engages with the
National Security Council and interagency partners on a natural gas
pipelines Industrial Control Systems Cybersecurity Initiative and other
work to tackle cyber threats from adversaries who seek to compromise
critical systems that are essential to U.S. national and economic
security.
Our Policy office coordinates cybersecurity policy implementation
across our nine Operating Administrations. Our Research and Technology
office and Volpe National Transportation Systems Center support our
Operating Administrations to conduct research on cybersecurity
solutions and best practices as well as gaps that require new
approaches.
Finally, the Department's Office of the Chief Information Officer
(OCIO) manages internal cybersecurity initiatives and has led our
agency's response to the Executive Order on Improving the Nation's
Cybersecurity (EO 14028). In support of this Executive Order, the OCIO
is recruiting for new cybersecurity talent, has begun deploying new
capabilities, initiated a data sensitivity review, and has developed
new proposals to encrypt and protect data. The OCIO is also
collaborating with DOT Human Resources on management of DOT's
cybersecurity workforce.
Through all these efforts, DOT continues work with our sister
agencies, especially TSA and CISA, to invest in world class research
and pursue initiatives to address cybersecurity threats, including
risks to future transportation technologies and innovations.
III. DOT's Collaboration with Federal and Private Sector Partners
When it comes to pipeline cybersecurity, coordination, and
collaboration among our Federal partners is critical. Although DOT and
TSA are the co-sector risk management agencies for transportation
safety and security--including pipelines, CISA is the lead on
cybersecurity risk across critical infrastructure. CISA provides
alerts, warnings, advisories, guidance, and resources to help critical
infrastructure owners and operators bolster their cyber defenses.
DOT amplifies CISA's outreach by further distributing their vital
messages to sector stakeholders. DOT and DHS also encourage the
stakeholders to adopt the voluntary National Institute of Standards and
Technology Cybersecurity Framework, created through collaboration
between industry and government.
Protecting against malicious cyber actors requires the Federal
Government to partner with the private sector, which owns, operates,
and manufactures most of America's pipeline systems. The private sector
has a responsibility to adapt to the continuously evolving cyber threat
environment, to build and operate products securely, and protect the
security of critical infrastructure in partnership with the Federal
Government.
IV. Colonial Pipeline Successful Response and Lessons Learned
When the Colonial Pipeline cybersecurity hack occurred on May 7,
2021, President Biden immediately directed a whole of government
approach to respond to the attack. Under the leadership of Secretary
Buttigieg, DOT acted quickly to facilitate the transport of fuel to
affected regions, and to help get the pipeline system back up and
running.
PHMSA engaged around the clock, monitored the safety of the
pipeline, and worked with the pipeline company to help ensure a safe
restart. With our support, within days, the Pipeline was able to move
nearly a million barrels of fuel on a manual basis.
Traditionally, PHMSA regulates safe pipeline operations, and TSA
regulates cybersecurity. However, as we saw with the Colonial Pipeline,
cybersecurity can and does affect safe and reliable operations. In the
wake of this incident, PHMSA is revisiting the scope of integrity
management plan and emergency response plan requirements--to ensure
they account for cybersecurity attack contingencies.
PHMSA also continues to work closely with DHS and Federal partners,
and shares information we receive through our inspection processes.
V. Conclusion
The Colonial Pipeline cybersecurity incident spotlighted the
importance of trusted and timely information sharing as well as public
and private sector partnership in transportation cybersecurity. It also
underscored that we need to keep learning and adapting quickly to meet
increasingly complex and sophisticated cybersecurity challenges. DOT
will continue to work across the Federal Government and with the
private sector to advance the cybersecurity of the pipelines that fuel
and sustain our Nation.
Our transportation infrastructure has long been a bedrock of our
national security and economic prosperity. At DOT, we look forward to
working with this Committee and our agency and White House partners to
strengthen and protect that infrastructure. Thank you again for the
opportunity to testify, and I will be happy to answer your questions.
The Chairman. Thank you.
Ms. Gordon, welcome.
STATEMENT OF LESLIE V. GORDON,
ACTING DIRECTOR, HOMELAND SECURITY AND JUSTICE,
GOVERNMENT ACCOUNTABILITY OFFICE
Ms. Gordon. Good morning. Chair Cantwell, Ranking Member
Wicker, Members of the Committee, I'm very pleased to be with
you today and Administrator Pekoske, Deputy Secretary
Trottenberg, I'm happy to be here to discuss GAO's work on
pipeline security.
The May ransomware cyber attack against Colonial Pipeline's
information technology network exemplifies the cybersecurity
threats to critical infrastructure that we have reported on for
many years.
In 2018 our high-risk series on cybersecurity identifies
the urgent need to protect cyber-critical infrastructure as one
of the four major cybersecurity challenges for the Federal
Government and it remains an urgent need.
This morning I want to highlight a few of the steps that
TSA is taking to address some of the Pipeline Security Program
weaknesses that we and others have identified and note that
ongoing attention will be important.
TSA addressed 12 of GAO's 15 recommendations from our work
in 2018 and 2019. It clarified pipeline security guidelines,
improved performance monitoring, assessed staffing needs, and
updated guidance on Federal roles and responsibilities between
the TSA and PHMSA.
One recent step TSA took was to develop a strategic
workforce plan to assess its staffing needs. Both the number
and requisite skills, including cybersecurity, needed to
effectively meet Pipeline Security Program mission. As a part
of its workforce assessment and plan, TSA reported needing a 41
percent increase in staffing to perform the current and
projected pipeline security mission.
Also, subsequent to the Colonial Pipeline attack in May,
TSA issued a Security Directive that required, among other
things, critical pipeline owner-operators to assess whether
their current operations are consistent with TSA's recommended
cybersecurity asset measures in its pipeline security
guidelines, identify any gaps and remediation measures needed,
and report the results to TSA and others. Previously, pipeline
owner-operators' application of the pipeline guidelines was
voluntary.
In preparation for this hearing, we reviewed the security
measures for pipeline cyber assets in the guidelines and found
that they do not include several known mitigation strategies
for current cyber threats, including ransomware attacks.
In June TSA officials told us they anticipate updating the
guidelines over the next year.
Last week TSA issued another Security Directive that
requires critical pipeline owner-operators to implement
specific cybersecurity mitigation measures, develop a
cybersecurity contingency response plan, and undergo an annual
cybersecurity architecture design review, among other things.
This Security Directive is placing significant additional
cybersecurity requirements on private sector-owned pipeline
owner-operators and likely will generate additional information
for TSA on cybersecurity needs and likely add to TSA's volume
of work.
Both directives will be in effect for 1 year while pipeline
cybersecurity risks will continue.
This concludes my statement. I'd be happy to respond to
your questions.
[The prepared statement of Ms. Gordon follows:]
Prepared Statement of Leslie V. Gordon, Acting Director, Homeland
Security and Justice, U.S. Government Accountability Office
CRITICAL INFRASTRUCTURE PROTECTION
TSA Is Taking Steps to Address Some Pipeline Security Program
Weaknesses
Chair Cantwell, Ranking Member Wicker, and Members of the
Committee:
Thank you for the opportunity to discuss our work on the
Transportation Security Administration's (TSA) efforts to secure oil
and gas pipelines from physical and cyber threats. Pipelines are one
type of critical infrastructure, which includes assets and systems that
are so vital to the United States that their incapacity or destruction
would have a debilitating impact on our country. More than 2.7 million
miles of pipelines transport and distribute natural gas, oil, and other
hazardous liquids throughout the United States. People and businesses
depend on these products to operate vehicles and machinery, heat homes,
generate electricity, and manufacture products. A minor pipeline system
disruption could result in commodity price increases, while prolonged
pipeline disruptions could lead to widespread energy shortages.\1\
---------------------------------------------------------------------------
\1\ Transportation Security Administration, Biennial National
Strategy for Transportation Security: Report to Congress (Washington,
D.C.: Apr. 4, 2018).
---------------------------------------------------------------------------
Cyberattacks are among the most recent threats to the Nation's
pipeline systems. In May 2021, malicious actors used DarkSide
ransomware to conduct a cyberattack against Colonial Pipeline's
information technology network.\2\ This cyberattack exemplifies the
cybersecurity threats to critical infrastructure that we have reported
on for many years.\3\ In 1997, we designated information security as a
government-wide high-risk area and expanded it in 2003 to include
protecting cyber critical infrastructure.\4\ In 2018, our High Risk
Series on cybersecurity identified the urgent need to protect cyber
critical infrastructure as one of the four major cybersecurity
challenges for the Federal government.\5\
---------------------------------------------------------------------------
\2\ Ransomware is malicious software used to deny access to systems
or data until a ransom is paid.
\3\ GAO, High-Risk Series: Dedicated Leadership Needed to Address
Limited Progress in Most High-Risk Areas, GAO-21-119SP (Washington,
D.C.: March 2, 2021) and High Risk Series: An Overview, GAO-HR-97-1
(Washington, D.C.: February 1997). GAO maintains a high-risk program to
focus attention on government operations that it identifies as high
risk due to their greater vulnerabilities to fraud, waste, abuse, and
mismanagement or the need for transformation to address economy,
efficiency, or effectiveness challenges.
\4\ GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.:
January 2003).
\5\ GAO, High-Risk Series: Urgent Actions Are Needed to Address
Cybersecurity Challenges Facing the Nation, GAO-18-622 (Washington,
D.C.: Sep 06, 2018). GAO, High-Risk Series: Federal Government Needs to
Urgently Pursue Critical Actions to Address Major Cybersecurity
Challenges, GAO-21-288 (Washington, D.C.: March 24, 2021).
---------------------------------------------------------------------------
TSA, within the Department of Homeland Security (DHS), has primary
oversight responsibility for the physical security and cybersecurity of
transmission and distribution pipeline systems.\6\ TSA's Pipeline
Security Branch manages its pipeline security program. The Pipeline
Security Branch first issued voluntary Pipeline Security Guidelines in
2011 and released revised guidelines in March 2018 and April 2021.\7\
---------------------------------------------------------------------------
\6\ Transmission pipelines are used to transport crude oil and
natural gas from their respective gathering systems to refining,
processing, or storage facilities. Transmission pipelines also
transport refined petroleum products and natural gas to customers, for
use or for further distribution. With very few exceptions, transmission
pipelines are dedicated to the transportation of crude oil, refined
petroleum products, or natural gas.
\7\ Transportation Security Administration. Pipeline Security
Guidelines, March 2018 (with Change I (April 2021)).
---------------------------------------------------------------------------
In my testimony today, I will discuss: (1) actions TSA has taken to
address weaknesses we have previously identified in its pipeline
security program; (2) cybersecurity-related weaknesses we have
previously identified in the Nation's pipeline systems that TSA has not
fully addressed; and (3) TSA's guidance to pipeline owner/operators.
My discussion of the actions TSA has taken to address weaknesses in
its pipeline security program and the cybersecurity weaknesses that it
has not fully addressed is based on two reports we issued in December
2018 and June 2019, selected updates we conducted in May 2021, and
related information from our 2021 High Risk Series reports.\8\ For
these prior reports, we reviewed and analyzed relevant documents from
TSA and other Federal entities, evaluated TSA pipeline risk assessment
efforts, and interviewed TSA officials, including officials within
TSA's Pipeline Security Branch. We interviewed representatives from
five major industry associations and security personnel from 10
pipeline owner/operators to collect a range of perspectives on topics
relevant to pipeline security.\9\ While the information gathered during
the operator interviews cannot be generalized to all pipeline owner/
operators, it provides a range of perspectives on a variety of topics
relevant to pipeline security. Additional details on the scope and
methodology are available in our published reports.
---------------------------------------------------------------------------
\8\ GAO, Critical Infrastructure Protection: Actions Needed to
Address Significant Weaknesses in TSA's Pipeline Security Program
Management, GAO-19-48 (Washington, D.C.: Dec. 18, 2018); GAO, Critical
Infrastructure Protection: Key Pipeline Security Documents Need to
Reflect Current Operating Environment, GAO-19-426 (Washington, D.C.:
June 5, 2019); and GAO-21-288.
\9\ We selected the 10 pipeline owner/operators from TSA's list of
the top 100 critical pipeline systems and chose them to ensure a
mixture of the following characteristics: (a) type of pipeline
commodity transported (i.e., natural gas, oil, and hazardous liquids);
(b) volume of product transported; and (c) whether or not the pipeline
owner/operators' critical facilities had been the subject of a TSA
security review. We considered the location of selected owner/
operators' pipeline systems to ensure that a single state or region was
not overrepresented in our sample. We also observed TSA's security
reviews at three critical pipeline facilities from among the 10
selected pipeline systems.
---------------------------------------------------------------------------
To describe TSA's requirements and guidance to pipeline owner/
operators, we also reviewed TSA's recent Pipeline Security Directives,
its Pipeline Security Guidelines, and three security alerts.\10\ The
advisories we reviewed contained information on current cyber threats
including ransomware and known mitigation strategies.\11\ The
advisories direct critical infrastructure owner/operators to adopt
specific mitigation strategies, such as: implementing multifactor
authentication for remote access to networks; investigating
unauthorized connections; and addressing known vulnerabilities by
applying software patches or adopting other controls.
---------------------------------------------------------------------------
\10\ National Security Agency (NSA) and Cybersecurity and
Infrastructure Security Agency (CISA), NSA and CISA Recommend Immediate
Actions to Reduce Exposure Across Operational Technologies and Control
Systems, Alert (AA20-205A), July 23, 2020. CISA and the Federal Bureau
of Investigation (FBI), DarkSide Ransomware: Best Practices for
Preventing Business Disruption from Ransomware Attacks, Alert (AA21-
131A), May 11, 2021; TSA, Security Directive Pipeline-2021-01 (May 28,
2021); and CISA, Rising Ransomware Threat to Operational Technology
Assets, June 09, 2021, TSA Security Directive Pipeline-2021-02 (July
20, 2021).
\11\ The scope of this statement did not include an evaluation of
TSA's July 2021 Directive.
---------------------------------------------------------------------------
We conducted the work upon which this statement is based in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain
sufficient, appropriate evidence to provide a reasonable basis for our
findings and conclusions based on our audit objectives. We believe that
the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objectives.
Background
Cybersecurity Threats to Pipeline Systems
The interstate pipeline system runs through both remote and highly
populated urban areas, and transports oil, natural gas, and other
hazardous liquids. In addition to their vulnerability to physical
attacks, pipelines are vulnerable to cyberattacks or intrusions due to
their increased reliance on computerized systems and electronic data--
particularly industrial control systems.\12\ Industrial control systems
are increasingly connected in modern energy systems, allowing
cyberattacks that originate in business IT systems to migrate to
industrial control systems.\13\
---------------------------------------------------------------------------
\12\ According to TSA, pipelines are vulnerable to physical
attacks--including the use of firearms or explosives--largely due to
their stationary nature, the volatility of transported products, and
the dispersed nature of pipeline networks spanning urban and outlying
areas. Industrial control systems are typically network-based systems
that monitor and control sensitive processes and physical functions,
including those needed to operate pipelines.
\13\ For example, in 2015 malicious actors gained access to the
business IT networks on a Ukrainian electricity utility and used that
access to migrate to the utility's industrial control systems networks,
which rendered some systems inoperable.
---------------------------------------------------------------------------
The 2021 Annual Threat Assessment of the U.S. Intelligence
Community and the 2020 Homeland Threat Assessment, among others, note
that certain nations and criminal groups pose the greatest cyberattack
threats to U.S. critical infrastructure.\14\
---------------------------------------------------------------------------
\14\ Office of the Director of National Intelligence, Annual Threat
Assessment of the U.S. Intelligence Community (April 9, 2021).
Department of Homeland Security, Homeland Threat Assessment (October 6,
2020).
Nations of concern. China, Russia, Iran, and North Korea
have the ability to launch cyberattacks that could disrupt or
damage critical infrastructure, according to the Office of the
Director of National Intelligence's Annual Threat Assessment.
For example, China has the ability to disrupt a natural gas
pipeline for days to weeks.\15\
---------------------------------------------------------------------------
\15\ Federal agencies publicly identified and characterized nation-
state cyberattacks on several occasions. For example, the National
Cybersecurity and Communications Integration Center and the FBI
characterized Russian government actions as a multi-stage campaign
targeted at small U.S. commercial facilities' networks where they
gained remote access into energy sector networks. FBI and National
Cybersecurity and Communications Integration Center, Russian Government
Cyber Activity Targeting Energy and Other Critical Infrastructure
Sectors TA18-074A (Washington, D.C.: Mar., 16 2018 (revised)). Office
of the Director of National Intelligence, Annual Threat Assessment of
the U.S. Intelligence Community (Jan. 29, 2019). CISA and the FBI,
Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013, Alert (AA21-
201A) (July 20, 2021).
Criminal groups. In addition, according to the 2020 Homeland
Threat Assessment, cybercriminals increasingly will target
critical infrastructure to generate profit using ransomware by
exploiting gaps in the cybersecurity of critical infrastructure
---------------------------------------------------------------------------
entities.
These threat actors are capable of using a variety of tactics and
techniques that can facilitate cybersecurity incidents that have a
range of consequences. For instance, it may be possible for malicious
cyber actors to manipulate, interrupt, or disrupt pipeline owner/
operators' physical control processes or industrial control systems to
cause disruptions:
In the 2015 cyberattacks on the Ukrainian power grid,
attackers issued unauthorized commands to open the breakers at
substations that three regional electricity utilities managed,
causing a loss of power to about 225,000 customers.
In December 2019, a form of ransomware, named EKANS,
infected various industrial control systems devices, reportedly
in the U.S., Europe, and Japan, by encrypting files and
displaying a ransom note, which impaired operations.
Recent events highlight the significant cyber threats facing the
Nation's pipeline system. According to the Colonial Pipeline Company,
on May 7, 2021, the company learned that it was the victim of a
cyberattack. A joint alert from CISA and the Federal Bureau of
Investigation (FBI) indicated that malicious actors used DarkSide
ransomware against Colonial Pipeline's information technology
network.\16\ The alert also explained that, to ensure the safety of the
pipeline, the company disconnected certain industrial control systems
that monitor and control physical pipeline functions so that they would
not be compromised by the criminals.
---------------------------------------------------------------------------
\16\ CISA and the FBI, DarkSide Ransomware: Best Practices for
Preventing Business Disruption from Ransomware Attacks, Alert (AA21-
131A), May 11, 2021.
---------------------------------------------------------------------------
According to CISA and the FBI, as of May 11, there was no
indication that the DarkSide actors compromised the industrial control
systems. However, disconnecting these systems resulted in a temporary
halt to all pipeline operations. This in turn led to gasoline shortages
throughout the southeast United States.
Federal Cybersecurity Challenges
In March 2021, we reiterated the importance of addressing four
major cybersecurity challenges and 10 critical actions that the Federal
government and other entities need to take to address those challenges
(see fig. 1).\17\
---------------------------------------------------------------------------
\17\ GAO-21-288.
As we previously reported agencies need to urgently address the 10
critical actions to effectively position the Nation to prevent, or more
quickly detect and mitigate the damage of, future cyberattacks. Three
of these 10 critical actions are particularly relevant to pipeline
---------------------------------------------------------------------------
security:
Develop and execute a more comprehensive Federal strategy
for national cybersecurity and global cyberspace. The White
House's September 2018 National Cyber Strategy and the National
Security Council's accompanying June 2019 Implementation Plan
detailed the executive branch's approach to managing the
Nation's cybersecurity. However, in September 2020, we reported
that the strategy and implementation plan addressed some, but
not all, of the desirable characteristics of national
strategies, such as goals and resources needed.\18\ We
recommended that the National Security Council staff work with
relevant Federal entities to update cybersecurity strategy
documents to include goals and resource information, among
other things. The National Security Council staff neither
agreed nor disagreed with our recommendation and has yet to
address it.
---------------------------------------------------------------------------
\18\ GAO, Cybersecurity: Clarity of Leadership Urgently Needed to
Fully Implement the National Strategy, GAO-20-629 (Washington, D.C.:
Sept. 22, 2020).
We also highlighted the urgent need to clearly define a central
role for leading the implementation of the national strategy.
Accordingly, we suggested that Congress consider legislation to
designate a position in the White House to lead such an effort.
In January 2021, Federal law established the Office of the
National Cyber Director within the Executive Office of the
President.\19\ In April 2021, the President submitted his
nomination for a National Cyber Director to the Senate for
confirmation and in June 2021 the Senate confirmed the
President's nominee. Moving forward, the National Cyber
Director needs to either update the existing National Cyber
Strategy and Implementation Plan or develop a new comprehensive
strategy that addresses the desirable characteristics of
national strategies.
---------------------------------------------------------------------------
\19\ The William M. (Mac) Thornberry National Defense Authorization
Act for Fiscal Year 2021, Pub. L. No. 116-283, Sec. 1752, 134 Stat.
3388, 4144 (2021).
Address cybersecurity workforce management challenges.
Federal and nonfederal critical infrastructure entities
continue to face challenges in ensuring that their
cybersecurity workforce has the appropriate skills. For
example, according to a 2019 assessment from the Department of
Energy, the electricity subsector continues to face challenges
in recruiting and maintaining experts with strong knowledge of
cybersecurity practices, as well as knowledge of industrial
control systems supporting the electric grid.\20\ Further, we
reported in October 2020 that the Federal Aviation
Administration does not currently have a staff training program
specific to avionics cybersecurity and none of the agency's
certification staff are required to take cybersecurity training
tailored to their oversight roles.\21\ Until these challenges
are resolved, Federal and nonfederal critical infrastructure
entities may not have the expertise necessary to address the
increasing cybersecurity risks to their systems.
---------------------------------------------------------------------------
\20\ GAO, Critical Infrastructure Protection: Actions Needed to
Address Significant Cybersecurity Risks Facing the Electric Grid, GAO-
19-332 (Washington, D.C.: Aug. 26, 2019).
\21\ GAO, Aviation Cybersecurity: FAA Should Fully Implement Key
Practices to Strengthen Its Oversight of Avionics Risks, GAO-21-86
(Washington, D.C.: Oct. 9, 2020).
Strengthen the Federal role in protecting the cybersecurity
of critical infrastructure. Since 2010, we have made nearly 80
recommendations for various Federal agencies to enhance
infrastructure cybersecurity. For example, in February 2020, we
recommended that agencies better measure the adoption of the
National Institute of Standards and Technology (NIST) framework
of voluntary cyber standards and correct sector-specific
weaknesses.\22\ However, as of December 2020, most of these
recommendations (nearly 50) have not been implemented. As a
result, the risks of unprotected infrastructures being harmed
are heightened.
---------------------------------------------------------------------------
\22\ GAO, Critical Infrastructure Protection: Additional Actions
Needed to Identify Framework Adoption and Resulting Improvements, GAO-
20-299 (Washington, D.C.: February 25, 2020).
---------------------------------------------------------------------------
Pipeline Stakeholders' Security Roles and Responsibilities
Protecting the Nation's pipeline systems is a responsibility shared
by both TSA and private industry stakeholders. TSA's Pipeline Security
Branch conducts voluntary security reviews of the privately owned and
operated pipelines, among other activities. These reviews--Corporate
Security Reviews (CSR) and Critical Facility Security Reviews (CFSR)--
assess the extent to which the 100 most critical pipeline systems are
following the intent of TSA's Pipeline Security Guidelines.\23\ CSRs
are voluntary on-site reviews of a pipeline owner's corporate policies
and procedures. CFSRs are voluntary on-site inspections of critical
pipeline facilities, as well as other selected pipeline facilities,
throughout the Nation (see fig. 2).
---------------------------------------------------------------------------
\23\ TSA initially identifies the 100 highest risk pipeline systems
based on the amount of material transported through the system.
Subsequently, pipeline owner/operators are to use criteria in the
Guidelines to self-identify the critical facilities within those higher
risk systems and report them to TSA. TSA's Pipeline Security Branch
then conducts CFSRs at the critical facilities identified by pipeline
owner/operators. However, in December 2018 we reported that our
analysis of TSA's data found that at least 34 of the top 100 critical
pipeline systems TSA deemed highest risk indicated that they had no
critical facilities. GAO-19-48.
a TSA uses system annual throughput in determining the
top 100 critical pipeline systems, which is based on the amount of
hazardous liquid or natural gas product transported through a pipeline
---------------------------------------------------------------------------
in 1 year.
b Because of the voluntary nature of TSA's pipeline
security program, TSA requests selected operators to participate in its
pipeline security reviews--the CSR and CFSR.
c Under TSA's Pipeline Security Guidelines, pipeline
operators are to self-identify the critical facilities within their
pipeline system and report their critical facilities to TSA.
Following the Colonial Pipeline cyberattack, TSA issued Security
Directive Pipeline-2021-01 effective for one year beginning May 28,
2021 requiring certain pipeline owner/operators to take specific
actions to enhance pipeline cybersecurity.\24\ In this May 2021
Directive, TSA requires, among other things, certain pipeline owner/
operators to report cybersecurity incidents to DHS. The Directive also
requires pipeline owner/operators to designate a cybersecurity
coordinator and review current activities against TSA's recommendations
for pipeline cybersecurity to assess cyber risks, identify any gaps,
develop remediation measures, and report the results to TSA and
DHS.\25\
---------------------------------------------------------------------------
\24\ TSA Security Directive Pipeline-2021-01 (May 28, 2021).
\25\ TSA recommendations for pipeline cybersecurity are based on
Section 7 of the Guidelines, which describe security measures for
pipeline cyber assets.
---------------------------------------------------------------------------
In July 2021, TSA issued Security Directive Pipeline-2021-02:
Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and
Testing effective for one year beginning July 26, 2021.\26\ In this
July 2021 Directive, TSA establishes requirements for certain pipeline
owner/operators to implement cybersecurity mitigation measures; develop
a cybersecurity contingency and recovery plan; and undergo an annual
cybersecurity architecture design review, among other things.
---------------------------------------------------------------------------
\26\ TSA Security Directive Pipeline-2021-02 (July 20, 2021).
---------------------------------------------------------------------------
TSA Has Addressed Several Previously Identified Weaknesses in the
Management of Pipeline Security
Our December 2018 and June 2019 reports identified several
weaknesses in TSA's pipeline security program and made 15
recommendations to address them (see app. I). TSA has taken actions to
address several weaknesses in the management of pipeline security and
has fully addressed 12 of our recommendations related to four areas.
Specifically, TSA has clarified its pipeline security guidelines,
improved performance monitoring, assessed staffing needs, and updated
guidance on Federal roles and responsibilities:
Clarified pipeline security guidelines. In December 2018, we
found that TSA had revised the Pipeline Security Guidelines in
March 2018, but had not established a documented process to
ensure that revisions regularly occur and to fully capture
updates to supporting standards and guidance. For example,
while TSA revised its guidelines in March 2018 to incorporate
cybersecurity principles and practices from the NIST
Cybersecurity Framework, the revisions did not incorporate
cybersecurity elements that NIST added to the latest
Cybersecurity Framework the following month in April 2018, such
as the Supply Chain Risk Management category. We also found
that TSA did not specify clear criteria for pipeline owner/
operators to use in determining critical facilities.
In our December 2018 report, we recommended that TSA implement a
documented process for reviewing and revising its Pipeline
Security Guidelines, as well as clarify these Guidelines by
defining key terms within its criteria for determining critical
facilities. In March 2019, TSA officials established a
documented internal operating procedure for reviewing all of
TSA's surface transportation security guidance annually, which
include its Pipeline Security Guidelines, and updating it at
least once every 5 years or earlier if TSA determines that new
or revised guidance is in the public interest. According to TSA
officials, in December 2020, TSA also clarified critical
facility criteria by using existing regulatory terminology,
among other clarifications. These actions addressed our
recommendations.
Improved performance monitoring. In December 2018, we found
that TSA developed three databases to track CSR and CFSR
recommendations and their implementation status. Also, while
TSA used a database to track CFSR recommendations, we found
that TSA had not tracked the status of CSR recommendations for
security improvements in over 5 years. We recommended that TSA
take steps to enter information on CSR recommendations and
monitor and record their status. In April 2020, TSA reported
that it began updating and monitoring CSR recommendations in
its database.
Assessed staffing needs. In December 2018, we also found
that TSA had not established a workforce plan for its Pipeline
Security Branch that identified staffing needs or cybersecurity
skills required to best implement security reviews, such as
CSRs and CFSRs. We recommended that TSA develop a strategic
workforce plan that outlines the knowledge, skills, and
abilities, including those related to cybersecurity, needed to
effectively conduct pipeline security reviews. TSA completed
the Workforce Assessment Report in May 2021. The Assessment
Report identified, among other things, several staffing
inadequacies, particularly related to the pipeline
cybersecurity mission. Specifically, the Assessment Report
highlighted that the organization lacks qualified personnel
with relevant skills, appropriate certifications, or expertise
in cybersecurity and that over one-third of the agency's
position descriptions were improperly classified for the duties
required.
TSA's Assessment Report also noted that TSA is short the necessary
positions to perform the current and projected pipeline
security mission, with a 41 percent increase in staffing needed
to position the organization for mission success.\27\ The
assessment includes a recommended workforce plan that defines
short-term and long-term initiatives for addressing the
staffing inadequacies. For example, the recommended workforce
plan lists initiatives for developing and codifying specific
duties required for physical or cybersecurity, budgeting to
fund new staff position requirements, and collaborating with
TSA's Human Capital office to recruit and hire needed staff.
These actions help ensure that TSA is able to meet its mission
of reducing pipeline systems' vulnerabilities to physical and
cybersecurity risks, especially in a dynamic and evolving
threat environment.
---------------------------------------------------------------------------
\27\ According to TSA officials, the Pipeline Security Branch
employed 34 staff as of June 2021.
Updated guidance for Federal pipeline security roles. We
reported in June 2019 on the need for key pipeline security
documents to reflect the current operating environment.
Specifically, in 2006, TSA and the Department of
Transportation's Pipeline and Hazardous Materials Safety
Administration (PHMSA) signed an annex to a memorandum of
understanding to further delineate their pipeline security-
related responsibilities.\28\ We found that the memorandum of
understanding had not been reviewed to consider pipeline
security developments since its inception and did not fully
reflect the agencies' pipeline security and safety activities.
Consequently, we recommended that the TSA and PHMSA
Administrators revise the annex, to include a provision
requiring periodic reviews of, and corresponding updates to,
the memorandum of understanding. As of February 2020, TSA and
PHMSA had addressed these recommendations by including a
provision in the memorandum of understanding that committed the
agencies to reviewing it at least once every 5 years.\29\
---------------------------------------------------------------------------
\28\ Department of Transportation's PHMSA regulates the safety of
pipelines operating within the United States.
\29\ The update also included several clarifications for how TSA
and PHMSA are to coordinate, such as lines of authority and
responsibility for interagency incident information sharing.
---------------------------------------------------------------------------
TSA Has Not Fully Addressed Two Previously Identified Pipeline
Cybersecurity-Related Weaknesses
TSA has not fully addressed two key pipeline cybersecurity-related
weaknesses we previously identified. These weaknesses include: (1)
incomplete information for pipeline security risk assessments and (2)
aged protocols for responding to pipeline security incidents. These
weaknesses correspond to three of the 15 recommendations from our
December 2018 and June 2019 reports.
Incomplete Information for Pipeline Security Risk Assessments
In December 2018, we reported that TSA had incomplete information
for pipeline security risk assessments. We reported the Pipeline
Security Branch had developed a risk assessment model that combines all
three elements of risk--threat, vulnerability, and consequence--to
generate a risk score for pipeline systems. The Pipeline Security
Branch developed the Pipeline Relative Risk Ranking Tool in 2007 for
use in assessing various security risks to the top 100 critical
pipeline systems based on volume of material transported through the
system (throughput).\30\
---------------------------------------------------------------------------
\30\ According to DHS, a risk assessment is a product or process
which collects information and assigns values to risks for the purpose
of informing priorities, developing or comparing courses of action, and
informing decision-making. A risk assessment is also considered the
appraisal of the risks facing an entity, asset, system, network,
geographic area or other grouping.
---------------------------------------------------------------------------
The risk ranking tool calculates threat, vulnerability, and
consequence for each pipeline system on variables such as the amount of
throughput in the pipeline system and the number of critical
facilities. According to TSA at the time of our review, it collected
these data from pipeline owner/operators, as well as other Federal
agencies such as the departments of Transportation and Defense. The
risk ranking tool then generates a risk score for each of the 100 most
critical pipeline systems and TSA uses the risk scores to prioritize
its pipeline security assessments.
We made four recommendations to improve TSA's risk ranking tool in
our December 2018 report. TSA implemented two of the recommendations
but, as of June 2021, has not fully addressed the remaining two (see
app. I).\31\ One recommendation TSA has not fully addressed is that it
identify or develop data sources relevant to threat, vulnerability, and
consequence, and incorporate that data into the Pipeline Relative Risk
Ranking Tool. Such data sources could include information not tracked
by TSA as of our December 2018 report, such as data on cybersecurity
threats, prior attacks, natural hazards, physical pipeline condition,
and cross-sector interdependencies.\32\ TSA also has not yet conducted
a peer review of its risk ranking tool, as we recommended. TSA stated
that doing so was contingent on first enhancing the tool in accordance
with our other open recommendation. Addressing these recommendations is
important, as developing this information and incorporating it into the
risk ranking tool would provide more assurance that the Pipeline
Security Branch ranks relative risk among pipeline systems using
comprehensive and accurate data.
---------------------------------------------------------------------------
\31\ TSA implemented our recommendations to (1) update the Pipeline
Relative Risk Ranking Tool to include up-to-date data to ensure it
reflects industry conditions, including throughput and threat data; and
(2) document the data sources, underlying assumptions, and judgments
that form the basis of the Pipeline Relative Risk Ranking Tool,
including sources of uncertainty and any implications for interpreting
the results from the assessment.
\32\ Cross-sector interdependencies, as described in the 2013
National Infrastructure Protection Plan, concerns how infrastructure
sectors interact, including through reliance on shared information and
communications technologies (e.g., cloud services) and how that
interaction shapes how the Nation's critical infrastructure partners
should collectively manage risk. For example, all critical
infrastructure sectors rely on functions provided by energy,
communications, transportation, and water systems, among others. In
addition, interdependencies flow both ways, as with the dependence of
energy and communications systems on each other and on other functions.
---------------------------------------------------------------------------
Aged Protocols for Responding to Pipeline Security Incidents
In June 2019, we reported that TSA had not reviewed or revised its
2010 Pipeline Security and Incident Recovery Protocol Plan to ensure it
addressed changes in at least three key areas.\33\ The 2010 plan's
stated intent is to establish a comprehensive interagency approach to
counter risks, coordinate Federal agencies' actions, and minimize the
consequences of incidents involving pipeline infrastructure as well as
recovery time from them.\34\ The plan also defines the roles and
responsibilities of Federal agencies; tribal, state, and local
governments; and the private sector during a pipeline incident and the
measures they may take related to pipeline infrastructure security
incidents. According to the plan, TSA, PHMSA, the Department of Energy,
and the Federal Bureau of Investigation have principal roles in
pipeline incident response, while other agencies such as the U.S. Coast
Guard and the Federal Emergency Management Agency have supporting
roles. TSA's plan states that it will be updated periodically to
address changes in pipeline security threats, technology, and Federal
laws and policies. However, we reported in June 2019 that TSA had not
reviewed or revised its 2010 plan to ensure it addresses changes in at
least three key areas: cybersecurity-related laws and policies, Federal
incident management policies for pipeline stakeholders, and DHS's
terrorism alert system.
---------------------------------------------------------------------------
\33\ GAO-19-426.
\34\ The plan defines a pipeline security incident as any event
determined by DHS or TSA to be significant enough to warrant
monitoring. Such an event could be an occurrence, natural or manmade,
requiring a response to protect life or property, including major
disasters, emergencies, terrorist attacks, terrorist threats, civil
unrest, wild land and urban fires, floods, hazardous materials spills,
nuclear accidents, aircraft accidents, earthquakes, hurricanes,
tornadoes, tropical storms, tsunamis, war-related disasters, public
health and medical emergencies, and other occurrences requiring an
emergency response.
---------------------------------------------------------------------------
Representatives of the four pipeline associations we interviewed at
the time of our June 2019 report told us that their membership more
clearly understood Federal agencies' roles and responsibilities related
to physical incidents than to cybersecurity. All of these associations'
representatives told us that the process for reporting a cyber incident
was less clear because, in part, of the large number of Federal
agencies with a cybersecurity-related role. Further, they indicated
that clarifying the cybersecurity roles and responsibilities of the
Department of Energy, Federal Energy Regulatory Commission, and TSA
would improve owner/operators' ability to appropriately report and
respond to a cyber incident.
We recommended that TSA periodically review and, as appropriate,
update the 2010 Pipeline Security and Incident Recovery Protocol Plan
to ensure the plan reflects relevant changes in pipeline security
threats, technology, Federal law and policy, and any other factors
relevant to the security of the Nation's pipeline systems. According to
TSA officials as of May 2021, TSA completed a review of the plan and
determined that updates are needed and will require coordination with
other agencies. Fully addressing our recommendation will better ensure
that Federal agencies' actions are well-coordinated in response to a
pipeline-related physical or cyber incident, and that pipeline
stakeholders understand Federal agencies' roles and responsibilities in
helping pipeline owner/operators to restore service after a pipeline-
related physical or cyber incident.
TSA's Pipeline Security Directives Mandate Mitigation Strategies for
Cyber Threats
TSA's May 2021 Directive requires certain pipeline owner/operators
to take three specific actions--report cybersecurity incidents to DHS,
designate a cybersecurity coordinator, and review their current
activities against the Pipeline Cyber Asset Security Measures in TSA's
Pipeline Security Guidelines. It directs these pipeline owner/operators
to assess whether their current operations and activities to address
cyber risks are consistent with the Guidelines, identify any gaps,
develop remediation measures, and report the results to TSA and CISA by
the end of June 2021.\35\
---------------------------------------------------------------------------
\35\ TSA Security Directive Pipeline-2021-01 (May 28, 2021). The
Directive calls for owner/operators to report assessment results using
a TSA-provided form that, once completed, is protected as sensitive
security information.
---------------------------------------------------------------------------
TSA's July 2021 Directive mandates that certain pipeline owner/
operators implement cybersecurity mitigation measures; develop a
cybersecurity contingency and recovery plan in the event of an
incident; and undergo an annual cybersecurity architecture design
review, among other things.\36\ According to TSA, the July 2021
Directive was developed in consultation with CISA to include many of
the cybersecurity mitigation measures noted in recent security
alerts.\37\
---------------------------------------------------------------------------
\36\ TSA Security Directive Pipeline-2021-02 (July 20, 2021).
\37\ NSA and CISA, NSA and CISA Recommend Immediate Actions to
Reduce Exposure Across Operational Technologies and Control Systems,
Alert (AA20-205A), July 23, 2020. CISA and the Federal Bureau of
Investigation (FBI), DarkSide Ransomware: Best Practices for Preventing
Business Disruption from Ransomware Attacks, Alert (AA21-131A), May 11,
2021; TSA, Security Directive Pipeline-2021-01 (May 28, 2021); and
CISA, Rising Ransomware Threat to Operational Technology Assets, June
09, 2021, TSA Security Directive Pipeline-2021-02 (July 20, 2021).
---------------------------------------------------------------------------
TSA's recent security directives are important requirements for
pipeline owner/operators, because the agency's Pipeline Cyber Asset
Security Measures in its Pipeline Security Guidelines do not include
several known mitigation strategies for current cyber threats,
including ransomware attacks.\38\ In June 2021, TSA officials told us
that a timely update to address current cyber threats is appropriate
and said that they anticipate updating the Guidelines over the
subsequent year. Officials stated that time is needed to consult with a
wide range of industry stakeholders before finalizing the update.
---------------------------------------------------------------------------
\38\ The scope of this statement did not include an evaluation of
TSA's July 2021 Directive. However, our preliminary observations
indicate that this security directive is placing significant additional
cybersecurity requirements on private sector pipeline owner/operators
and additional oversight will be important going forward.
---------------------------------------------------------------------------
Chair Cantwell, Ranking Member Wicker, and Members of the
Committee, this completes my prepared statement. I would be pleased to
respond to any questions that you may have at this time.
______
Appendix I: Status of Selected GAO Recommendations to Strengthen
Transportation Security Administration (TSA) Oversight of Pipelines
Table 1: Status of Selected GAO Recommendations to Strengthen Transportation Security Administration (TSA's)
Oversight of Pipelines, through June 2021
----------------------------------------------------------------------------------------------------------------
Status of recommendation and actions needed if not
GAO recommendation fully implemented
----------------------------------------------------------------------------------------------------------------
Actions needed to address significant weaknesses in TSA's pipeline security program management
----------------------------------------------------------------------------------------------------------------
Implement a documented process for reviewing, and if Recommendation implemented.
deemed necessary, for revising TSA's Pipeline Security
Guidelines at regular defined intervals. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Clarify TSA's Pipeline Security Guidelines by defining Recommendation implemented.
key terms within its criteria for determining critical
facilities. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Develop a strategic workforce plan for TSA's Security Recommendation implemented.
Policy and Industry Engagement's Surface Division,
which could include determining the number of
personnel necessary to meet the goals set for its
Pipeline Security Branch, as well as the knowledge,
skills, and abilities, including cybersecurity, that
are needed to effectively conduct Corporate Security
Reviews (CSR) and Critical Facility Security Reviews
(CFSR). (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Update the Pipeline Relative Risk Ranking Tool to Recommendation implemented.
include up-to-date data to ensure it reflects industry
conditions, including throughput and threat data. (GAO-
19-48)a
----------------------------------------------------------------------------------------------------------------
Fully document the data sources, underlying assumptions Recommendation implemented.
and judgments that form the basis of the Pipeline
Relative Risk Ranking Tool, including sources of
uncertainty and any implications for interpreting the
results from the assessment. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Identify or develop other data sources relevant to Not fully implemented.
threat, vulnerability, and consequence consistent with DHS stated that TSA will incorporate that data into the
the National Infrastructure Protection Plan and Pipeline Risk Ranking Tool to assess relative risk of
Department of Homeland Security (DHS) critical critical pipeline systems, which could include data on
infrastructure risk mitigation priorities and prior attacks, natural hazards, feedback data on
incorporate that data into the Pipeline Relative Risk pipeline system performance, physical pipeline
Ranking Tool to assess relative risk of critical condition, and cross-sector interdependencies.
pipeline systems, which could include data on prior Identifying or developing other sources relevant to
attacks, natural hazards, feedback data on pipeline threat, vulnerability, and consequence consistent with
system performance, physical pipeline condition, and the National Infrastructure Protection Plan and DHS
cross-sector interdependencies. (GAO-19-48)a critical infrastructure risk mitigation priorities,
and incorporating it into the risk ranking tool, would
provide more assurance that TSA ranks relative risk
among pipeline systems using comprehensive and
accurate data.
----------------------------------------------------------------------------------------------------------------
Coordinate an independent, external peer review of Not fully implemented.
TSA's Pipeline Relative Risk Ranking Tool, after the DHS stated that, after completing enhancements to its
Pipeline Security Branch completes enhancements to its risk assessment approach, TSA will take steps to
risk assessment approach. (GAO-19-48)a coordinate an independent, external peer review of its
Pipeline Relative Risk Ranking Tool. Better
considering threat, vulnerability, and consequence
elements in its risk assessment and incorporating an
independent, external peer review in its process would
provide more assurance that the Pipeline Security
Branch ranks relative risk among pipeline systems
using comprehensive and accurate data and methods.
----------------------------------------------------------------------------------------------------------------
Ensure that TSA has a suite of performance measures Recommendation implemented.
which exhibit key attributes of successful performance
measures, including measurable targets, clarity, and
baseline and trend data. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Take steps to enter information on CSR recommendations Recommendation implemented.
and monitor and record their status. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Improve the quality of TSA's pipeline security program Recommendation implemented.
data by developing written documentation of its data
entry and verification procedures, implementing
standardized data entry formats, and correcting
existing data entry errors. (GAO-19-48)a
----------------------------------------------------------------------------------------------------------------
Key pipeline security documents need to reflect current operating environment
----------------------------------------------------------------------------------------------------------------
Work with the Pipeline and Hazardous Materials Safety Recommendation implemented.c
Administration (PHMSA) Administrator to develop and
implement a timeline with milestone dates for
reviewing and, as appropriate, updating the 2006 MOU
Annex. (GAO-19-426)b
----------------------------------------------------------------------------------------------------------------
In consultation with the PHMSA Administrator, revise Recommendation implemented.c
the 2006 MOU Annex to include a provision requiring
periodic reviews of, and as appropriate, corresponding
updates to the Annex. (GAO-19-426)b
----------------------------------------------------------------------------------------------------------------
Periodically review, and as appropriate, update the Not fully implemented.
2010 Pipeline Security and Incident Recovery Protocol As of June 2021, TSA officials reported that they
Plan to ensure the plan reflects relevant changes in completed a review of the Pipeline Security Incident
pipeline security threats, technology, Federal law and Recovery Protocol Plan and determined that updates are
policy, and any other factors relevant to the security needed. The updates require additional coordination
of the Nation's pipeline systems. (GAO-19-426)b with PHMSA as well as internal review within TSA,
according to TSA officials. By periodically reviewing
and, as appropriate, updating its plan, TSA could
better ensure it addresses changes in pipeline
security threats and Federal law and policy related to
cybersecurity, incident management and DHS's terrorism
alert system, among other things. TSA could also
provide greater assurance that pipeline stakeholders
understand Federal roles and responsibilities related
to pipeline incidents, including cyber incidents, and
that response efforts to such incidents are well-
coordinated.
----------------------------------------------------------------------------------------------------------------
Source: GAO. | GAO-21-105263
a Critical Infrastructure Protection: Actions Needed to Address Significant Weaknesses in TSA's Pipeline
Security Program Management, GAO-19-48 (Washington, D.C.: December 18, 2018).
b Critical Infrastructure Protection: Key Pipeline Security Documents Need to Reflect Current Operating
Environment, GAO-19-426 (Washington, D.C.: June 5, 2019).
c This recommendation was also implemented by PHMSA, in coordination with TSA.
The Chairman. Thank you, Ms. Gordon, and again thanks to
all the witnesses for their testimony.
I want to also mention that Senator Wicker and I today are
sending a letter to the Secretary of Commerce about the need to
upgrade and identify information and proprietary information
critical to our security system.
The nation's reliance on cyber-enabled systems demands that
the Department of Commerce, including the National Institute of
Standards and Technology, deepen its critical role in
protecting the Nation from cybersecurity threats vulnerability
and funding that matches the seriousness of this threat. So
flat funding of the Department of Commerce cybersecurity
efforts while growing the agency's budget, as reflected in the
President's request, is insufficient to meet these needs. So
we'll be sending that to the Department of Commerce today.
One of the things I wanted to mention--I also wanted to
enter one thing I didn't enter into the record was a--I love it
when we have bipartisan efforts--Cybersecurity Rules Needed for
Pipelines by FERC Commissioners Neal Chatterjee and Richard
Glick, shows you that this issue, along with that GAO report,
has been showing since 2018 that we have a serious problem here
and now we have the Colonial Pipeline as a very loud example.
[The information referred to follows:]
Colonial Pipeline Cyber Attack Highlights Need For More Seriousness In
Energy Policy
By David Blackmon, Senior Editor--May 13, 2021 9:21am EDT
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
WASHINGTON, DC--MAY 11: Secretary of Energy Jennifer Granholm
briefs reporters on the cyber attack . . . [+] GETTY IMAGES
With Colonial Pipeline now in the process of being restarted, we
can hope that the major disruptions to gasoline supply and resulting
spikes in gas prices in the 17 states the system serves will be
relieved in a matter of days. The danger in that potentially happy
outcome resides in the possibility that appropriate concerns about the
security of critical infrastructure in the U.S. will dissipate along
with the disruptions.
Colonial is unique in the scale and scope of its service area and
volume of deliveries. No other U.S. pipeline can say it delivers 45% of
total gasoline supplies across 17 states on a daily basis. But it is
also a vital part of a highly-interconnected national gasoline
transportation network in which major disruptions in one segment can
ultimately result in nationwide impacts to consumers and the economy.
Think of the nation's gasoline transportation network in the same
way we think of an electrical power grid. The loss of significant
generation capacity in one segment of a power grid can result in
system-wide blackouts as power is diverted from other parts of the grid
to fill in the void. Had the Colonial outage lingered for weeks instead
of mere days, we could have seen the same kind of domino effect across
the national transportation and delivery network. We know this because
we have seen it happen related to major, long-term pipeline outages in
the past.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
Motorists line up at an EXXON station selling gas at $3.29 per
gallon soon after it's fuel supply . . . [+] AFP VIA GETTY IMAGES
The U.S. pipeline infrastructure system is vulnerable to terrorist
attack, and make no mistake about it, the group that appeared to take
credit for the Colonial attack is a group of terrorists. The fact that
the U.S. legal system is so inept at dealing with this kind of
terrorism and so rarely exacts any form of harsh punishment for such
actions belies a lack of seriousness in addressing what is a growing
problem.
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
WASHINGTON, DC--MAY 10: Deputy National Security Advisor for Cyber
and Emerging Technology Anne . . . [+] GETTY IMAGES
The same applies to the Biden/Harris administration's posturing
towards the pipeline business in general. Much has been made of
statements made by two administration officials this week in reaction
to the Colonial situation.
On Monday, Anne Neuberger, deputy national security advisor for
cyber and emerging technologies, when asked by White House reports a
about whether Colonial would consent to the terrorists' ransom demand,
said ``Typically that's a private sector decision . . . We recognize
that victims of cyberattacks often face a very difficult situation and
they have to just balance often the cost-benefit when they have no
choice with regards to paying a ransom. Colonial is a private company
and we'll defer information regarding their decision on paying a ransom
to them,'' Neuberger said. [Note: A report at Bloomberg on May 13
indicates that the company did pay $5 million in ransom to the
terrorist group.]
Then on the next day, Energy Secretary Jennifer Granholm admitted
during another White House press briefing that ``pipe is the best way''
to transport fuel. While both statements by both senior officials are
obviously correct, it is legitimate to ask where their voices were on
January 20, when their President cancelled the Keystone XL Pipeline
project.
The decision by TC Energy to build Keystone XL was after all a
private sector decision based on a cost-benefit analysis related to
market demand for such a pipeline's services. The alternative to
Keystone XL is to move the Canadian crude oil it would transport to
market on thousands of trucks and many trains every day, obviously less
safe and more environmentally impactful ways of moving fuel.
Yet, despite the fact that TC Energy had met and even exceeded the
regulatory and permitting requirements across two different
presidential administrations, and despite the fact that the private
company had already invested billions of dollars and constructed
hundreds of miles of the line itself by January 20, President Biden
cancelled all of that, along with thousands of high-paying blue-collar
jobs, with the stroke of a pen during his first day in office.
The stark dichotomy of logic surrounding this administration's
decision-making related to Colonial and Keystone XL belies a lack of
seriousness in and highly-charged political nature of the choices it
makes in the energy space.
America's news and entertainment media today are filled with hopes
and dreams about an all-renewable energy future materializing somewhere
down the road, and that's great. In the meantime, though, Americans
still need to get to work and take their kids to school each day, and
99% of them are doing that in automobiles powered by gasoline and
diesel fuel. That heavy reliance on gasoline and diesel-fueled cars is
likely to predominate for decades to come, and that means America will
have to continue building and maintaining pipelines across those
decades.
When it comes to energy policy and the nation's critical pipeline
infrastructure, Americans deserve a little more seriousness and
consistency than they have received thus far from this presidential
administration.
______
[GRAPHICS NOT AVAILABLE IN TIFF FORMAT]
The Chairman. So I guess I just want to start with
something very basic here because you guys talked a lot about
interagency coordination. I'm not sure that Americans are
really interested in, you know, our internal interagency
coordination. What they're interested in is critical
infrastructure being protected.
So one of the things that I feel here is that the
complexity of this issue is getting away from us a little bit
in the context of it is very complex and the demands of
cybersecurity are very complex. They're not too complex not to
implement, but they are very complex and I have a feeling that
we're not keeping pace with some of these solutions.
If the witnesses would answer do you think that that's the
case? What do you think we need to do to better implement
cybersecurity solutions so that we can move forward?
Mr. Pekoske. Chair Cantwell, I agree with your comment and
certainly, you know, cyber moves fast and changes very quickly.
We need to keep pace with that.
We try to tie our requirements to NIST standards and NIST
keeps--you know, NIST is pretty much state-of-the-art with
respect to cybersecurity in our view.
The other thing that I feel is very, very important here,
as you mentioned, this is an ecosystem, it's very
interconnected, is to stay very connected and very
collaborative with our private sector partners, and I use that
partner term intentionally because, you know, we're only going
to be successful here if this partnership is successful.
The other thing I would highlight is that Surface
Transportation Security Advisory Committee, which includes
owners and operators across surface transportation and agency
representatives, and so that gives us a good opportunity to
come together and to look at the issues facing surface and
pipelines and figure out the best way to move forward.
So I think we have mechanism in place to do that. The key,
though, is going to be key coordination and communication
amongst all parties.
The Chairman. Ms. Trottenberg.
Ms. Trottenberg. I'll just add a bit to what the
Administrator said.
No question obviously in the transportation field, as in so
many others, the technological advances are extraordinary, you
know. Again, as I discussed in my testimony, in terms of, you
know, the remarkable operational systems we now have in
pipelines, we're seeing in vehicles, sort of across a lot of
our different modes.
I think the Administrator put it well. We are, you know, as
an agency now, I think, trying to work ever more closely with
TSA, with CISA, with our White House partners, and to have that
partnership with industry. You know, as we move forward in this
more technological age, we are going to need to be, you know,
as you were pointing out, Chair Cantwell, very, very cutting
edge, very nimble, and very collaborative.
The Chairman. Ms. Gordon.
Ms. Gordon. I think you're exactly right, Chair Cantwell.
This is a dynamic environment and one where the threats are
almost unknowable at times.
GAO has three open recommendations still for the TSA. One
of them is to develop additional data sources, beyond what
they're drawing on from the private sector, to better
understand and rank their priority pipeline systems and so we
are looking for them to add additional data sources to their
priority relative ranking tool and those might include cyber
threats, prior attacks, the physical condition of the pipelines
themselves, and inter-sector, interdependencies.
The Chairman. So what do you--I mean, I just don't think
for the American public and the vulnerability that Colonial
laid bare to all of us, people just want to hear more about,
you know, the need for this interagency coordination.
What do you think we need to do to get technology
implemented faster?
Ms. Gordon. GAO has over 950 open recommendations about
cybersecurity Federal Government-wide. We've put out 3,700
recommendations on cybersecurity for the Federal Government
since 2010 and 950 remain open.
The Chairman. So I will turn to my colleague here because I
see my time has expired, but many people will see I was very
aggressive with the Trump Administration about this. I plan to
be very aggressive with the Biden Administration about this, as
well. This is just not acceptable after the Colonial Pipeline.
It wasn't acceptable before but now we know how serious the
threat can be and the challenges that we face are really, you
know, as I have mentioned the New York Times clip, now people
know, now people know, and so we have to do better.
I'll turn to my colleague, but I'm sure he has spent many
hours in the skiff. I've spent many hours in the skiff on this
issue. There are things that can be done. We should be doing
them now.
Senator Wicker.
Senator Wicker. I'm astounded by the hundreds of open
recommendations that you mentioned.
Are they overlapping? I'm just--I can't conceive of that.
I'm even reluctant to ask you to supplement the record by
sending them all to us.
Ms. Gordon. We've been reporting on cybersecurity as a
high-risk issue for a number of years. So they span a decade,
11-12 years of work right now.
They focus in on four major challenges that the Federal
Government faces which are developing a comprehensive cyber
strategy, securing Federal systems and information, protecting
cyber-critical infrastructure, what we're talking about today,
and protecting privacy and sensitive data. So those are the
four major challenges for cybersecurity that GAO has reported
on.
Senator Wicker. OK. Well, let's talk about the Security
Directive done just a month or two ago, this year, and then a
second Security Directive on July 20th, just a day or two ago.
This was done without traditional rulemaking process, such as
notice and comment.
Ms. Gordon, we can go back this way, is that a problem at
all? What observations do you have about that shortcut? Was it
necessary, and what advice can you give us?
Ms. Gordon. TSA has the authority to regulate in this
space. TSA has the authority to regulate transportation modes.
So they were well within their authorities to issue the May
Directive and it was a step toward gathering additional
information that the agency may need about the status of the
security of the pipelines.
Senator Wicker. Do you think us stakeholders' viewpoints
were heard during this necessarily hurried-up process?
Ms. Gordon. I have no way to know that.
Senator Wicker. Anybody else want to comment?
Mr. Pekoske. Yes, Senator. The stakeholder concerns were
heard throughout the entire process.
I would suggest that the Security Directive process
actually enables the flexibility and agility, Chair Cantwell,
that you talked about. To go through a rulemaking process is a
lengthy process.
Security directives can be implemented immediately and then
once a security directive is implemented with that coordination
in advance, it doesn't mean that industry had all the things
that they wanted or wanted out of a security directive, but we
considered their input, we issue it, and then we have a
procedure within the security directive regime that allows an
affected industry partner to say, hey, I see your requirement
here, I see what security outcome you're trying to achieve.
I've got a better way to do that and that also keeps us on the
leading edge of cybersecurity.
So the industry representative will submit that alternative
procedure to us. We will rapidly review it and provide them an
answer back. So there is a lot of flexibility and speed built
into the security directive process.
Additionally, the security directives are traditionally
when they're first issued oftentimes issued for a year. They
can be renewed in increments following that or we can follow
another process to actually go through a formal notice and
comment rulemaking. We haven't determined what the path ahead
is for that in the longer term, but, you know, I just look at
Colonial.
I don't think anybody could have acted faster than we did
with our Security Directive authority and given that the
requirements we placed on the industry were consistent with
NIST cybersecurity framework requirements and consistent with
our pipeline security guidelines, which the industry helped us
build, there really weren't a lot of surprises in my view
there. It's just the scope and the speed.
Finally, I would submit that speed is really important
here. Senator, you know,----
Senator Wicker. Well, let me just interject and perhaps you
can supplement that answer.
I agree with you. I think government should be nimble in
situations like this and I know there has been a frustration on
this side of the dais that government is quite often slow and
creaky. So I commend you for that.
Let me just ask does anybody want to comment about the
possibility of condemning China for cyber attacks but not
imposing sanctions, to actually impose consequences on China?
Would someone like to comment on that?
Mr. Pekoske. I would just offer that, you know, this is a
long-term process and imposing sanctions on a foreign power is
not something as an agency administrator that I would have
independent authority to do, but certainly the National
Security Council process, irregardless of Administration, that
is where those issues are fully vetted and with robust
participation from the affected agencies.
Senator Wicker. Do you have an idea of individual officials
in China that we could point to as being offenders in this
regard?
Mr. Pekoske. I do not have that information, sir.
Senator Wicker. All right. Thank you very much, appreciate
it, Madam Chair.
The Chairman. Yes. Senator Klobuchar.
STATEMENT OF HON. AMY KLOBUCHAR,
U.S. SENATOR FROM MINNESOTA
Senator Klobuchar. Thank you very much, and thank you,
Madam Chair and Ranking Member Wicker, for holding this really
important hearing.
I think we all know how bad this is and how scary this is.
I was just thinking back to years of classified and
unclassified briefings where we were told that this threat,
particularly two things, like the power grid, is the biggest
threat out there for America, and I know that the Chair talked
about the interagency coordination.
I'm just looking at what our biggest challenges to get us
to the point where as sophisticated as the people who are
messing around with us. I think one of those challenges is
workforce and, of course, resources is tied in, but let's say
we have the resources. We devote the resources to this. Where
do we get the workforce?
Ms. Gordon, in your testimony you highlighted a May 2021
Workforce Assessment Report completed in May by the TSA that
showed that the agency lacked qualified personnel with relevant
skills.
In your view, how can we increase the number of cyber-
security experts in the Federal Government?
Ms. Gordon. Thank you, Senator Klobuchar.
It is an issue not just for the TSA, it's government-wide.
Senator Klobuchar. Right.
Ms. Gordon. Well, we have reported on some potential
actions the prior Administrations have taken to address
workforce challenges and cybersecurity. They include using the
NICE Framework, that's a National Initiative for Cyber
Education, to identify and categorize Federal cybersecurity
workforce.
DHS has a Cyber Talent Management and that could be
expanded. Security clearance process needs to be rationalized
and really looked at carefully. It's a very long cumbersome
process.
We need to standardize training for cybersecurity for our
Federal workforce where it's needed so that the same folks who
are out inspecting pipelines and looking at other facilities
have the grounding and the same kind of training that we can
all rely on.
Cybersecurity Reservist Program has been suggested as an
opportunity to create a search capacity, as well.
I would also like to mention the Solarium Commission has
mentioned that we could appeal to people who want to provide
service to this country, you know, the desperate need we have
for the cybersecurity talent, and there could be a
consideration to authorizing additional agencies the pay
flexibilities that DoD and DHS have for cyber talent.
Senator Klobuchar. Right. Thank you.
Mr. Pekoske, you highlighted the Department of Homeland
Security's Cyber Workforce Initiative in your testimony.
Can you talk about some of the challenges, how you think we
can get at them? I just think it's a huge deal here.
Mr. Pekoske. Yes. Thanks, Senator, and I agree it's a huge
deal, and it's called the Cyber Talent Management System that
Ms. Gordon referenced.
It's been incredibly successful already. We hired across
the department over 300 people in very short order. This allows
us to go into a direct hire process which means you don't have
to go through the USAJobs process that takes a good amount of
time.
Additionally, we have pay flexibilities built into the
Cyber Talent Management System and so the cyber talent we
brought into TSA, a good portion of those individuals were
sourced through this new program.
The other thing that it recognizes is that for cyber
talent, you know, some individuals are not necessarily looking
at coming into the Federal Government and serving a 20-or-30-
year career. Candidly, the Federal Government could benefit
from some of those individuals coming into the government,
providing value to the government, returning to the private
sector, and then potentially coming back.
Senator Klobuchar. Senator Thune and I awhile back put a
bill that allowed for this more and, of course, you run into
classified issues and things like that, but again we've got to
figure that out.
Last question I've got is about I know that Senator Wicker
brought up working with the private sector. So, you know,
you've got the private sector owning a majority of the critical
infrastructure and a recent report highlighted that 51 percent
of businesses allocate no resources toward protections against
cyber threats. Small businesses comprise about one-half to
three-quarters of the victims of ransomware and they can't
exactly hire full-time cybersecurity experts.
What do you think the Federal Government should do with the
small businesses, with ones that aren't doing enough that are
bigger because it's got to be part of the answer? I'm not being
negative about these businesses. It's a reality here. How do we
work with them better?
Mr. Pekoske. Senator, I think a good way to work with small
businesses is to provide online available training and
discussions on cybersecurity issues and then provide--you know,
I mentioned the 200 inspectors that we have across TSA in 47
cities as a resource.
I would much rather prevent a cyber incident than respond
to one and so I think the Federal Government and state
governments have a role to play in assisting small businesses
and providing whatever support.
The other thing that I think is very helpful is running
through some exercises just to highlight to businesses where
there might be some vulnerabilities that they perhaps had not
considered and just figuring out how best to respond to the
situations that develop.
Senator Klobuchar. All right. Thank you. I'll ask you
something on the record, Ms. Trottenberg. I think I'm out of
time here, but thank you very much and thank you, Madam Chair.
I'm going to a Judiciary hearing on nearly the same topic. I
somehow think it will not be as pleasant.
The Chairman. Thank you, Senator Klobuchar.
Senator Klobuchar. All right. Thank you.
The Chairman. Senator Thune.
STATEMENT OF HON. JOHN THUNE,
U.S. SENATOR FROM SOUTH DAKOTA
Senator Thune. Thank you, Madam Chair.
Welcome, panel. Administrator Pekoske, welcome back to the
Committee.
GAO has continued to raise concerns regarding challenges
faced by Federal agencies in recruiting and maintaining its
cybersecurity workforce. I know that universities across the
country have responded to that demand by creating or
significantly expanding cybersecurity-related curricula.
For example, Dakota State University in Madison, South
Dakota, has significantly expanded its program in recent years
and was even designated as a Center for Academic Excellence by
both Department of Homeland Security and the National Security
Agency.
Could you describe how partnerships between Federal
agencies and universities improve TSA's ability to recruit a
skilled cybersecurity workforce?
Mr. Pekoske. Yes, Senator. Thank you and good to see you.
You know, we have a program in DHS called the DHS Honors
Program which is designed to do exactly that. It is to partner
with universities, to develop a relationship with them, and
then, you know, explore opportunities with graduates of those
programs coming into the Federal Government. It's been very
successful to date.
The other thing that's important here for us, as well, and
Ms. Gordon mentioned this in terms of our ability to assess
risk and use all the factors that are needed, particularly in a
very changing landscape with respect to surface transportation
security in particular, and one of the things that we are
looking at very seriously in TSA is developing an academic
panel across universities to get the leading edge of risk
mitigation thought, risk assessment thought, to ensure that we
stay very much with them on that leading edge.
I think we are already there. I just want to have that
assessment and really to be able to draw in on that talent.
Senator Thune. Is TSA currently facing cybersecurity
workforce challenges and, if so, what more can you do to
improve the recruitment and retention of a cybersecurity
workforce, and can you describe actions the agency's currently
taking to address some of those workforce shortages?
Mr. Pekoske. Senator, we have a Cyber Talent Management
System in place across the department at this point. It's a
direct hire opportunity, gives us also the opportunity to
provide up to 25 percent more pay for a commensurately graded
General Schedule position.
This has been very successful for us. We have great hope.
This, coupled with the DHS Honors Program and the university
outreach, we think, will make a very big difference for the
department.
Senator Thune. Ms. Gordon, do you have anything to add
regarding cybersecurity workforce challenges and the importance
of university partnerships?
Ms. Gordon. I think the cybersecurity challenges that the
Federal workforce faces are vast and going to be with us for a
long time.
I am not prepared to speak to the linkage between the
universities and the Federal workforce needs. Be happy to take
questions for the record. Thank you.
Senator Thune. OK. Ms. Trottenberg, you mention in your
testimony the Memorandum of Understanding between DOT and DHS,
specifically the updated delineation of responsibilities
between PHMSA and TSA for pipeline regulation as required by
the TSA Modernization Act of 2018.
Could you describe how these important updates, the MOU,
have benefited PHMSA guidance and directives related to
pipeline cybersecurity and where you see room for improvement?
Ms. Trottenberg. Yes, thank you for the question, Senator.
I think the updating of that MOU, and I'm sure my colleague
will speak about it, as well, gave us the opportunity, I think,
to get at, I know, something of interest to this committee,
making sure both agencies are bringing information gathered to
the table, sharing it with their partners, but we're also
making sure we're not duplicating efforts, and I know that's a
concern with industry as they're speaking to different
government agencies, making sure that they're hearing from us
with one voice, that we're not duplicating efforts or working
at cross purposes.
So the MOU tries to get at ensuring that our two agencies
are in that state of cooperation.
Senator Thune. OK. Administrator, anything to add on
improvements made to interagency coordination on guidance,
directives, and inspections by the updated----
Mr. Pekoske. Yes, Senator. Just a couple briefly.
One, to add to Deputy Secretary Trottenberg's comment, that
MOU is a very significant positive step forward. Built into the
MOU is a requirement that we update that at least at 5-year
intervals. It was a built-in update mechanism.
The other thing I would add, sir, is the Modernization Act
established the Surface Transportation Security Advisory
Committee, which includes members from the pipeline sector as
well as other surface transportation sector owners and
operators, but all of the DOT modal administrations are members
of that committee, as is the Department of Energy, CISA, and
the Coast Guard.
So that committee, it provides us advice, has a very
integrated approach to the advice that they provide us.
Senator Thune. Could you talk a little bit about--I don't
have much time here--quickly improved coordination with PHMSA?
Has that enhanced the variety of data resource or data sources,
I should say, incorporated into the Pipeline Relative Risk
Ranking Tool?
Mr. Pekoske. Yes, sir, it does, and it also has a very
significant benefit of making sure that whatever security
requirements we put in place don't have an unintended safety
consequence.
So if we work that up front and then if we find issues, we
work that very quickly together, I think it's very positive for
everybody.
Senator Thune. Thank you. Thank you, Madam Chair.
The Chairman. Senator Rosen.
[No response.]
The Chairman. Senator Rosen.
[No response.]
The Chairman. If not, Senator Fischer. Senator Fischer, are
you available?
STATEMENT OF HON. DEB FISCHER,
U.S. SENATOR FROM NEBRASKA
Senator Fischer. I am, Madam Chairman.
The Chairman. Thank you.
Senator Fischer. Thank you very much.
Administrator Pekoske, under the 2020 Annex to the
Memorandum of Understanding between TSA and PHMSA, TSA
committed ``to the extent practicable TSA will consult with
PHMSA prior to disseminating requirements, voluntary standards,
best practices, and guidelines to the public.''
I've heard from some stakeholders that the requirements in
TSA's second Pipeline Security Directive issued last week are
operationally challenging.
Can you describe the extent of TSA's outreach to PHMSA to
seek feedback on the operational impact the Security Directive
would have on pipeline operators and to what extent the TSA
incorporates PHMSA's feedback into that directive?
Mr. Pekoske. Thank you, Senator Fischer, for the question.
We coordinated with PHMSA in advance of issuing the second
Security Directive and, to the best of my knowledge,
incorporated it as fully as we could PHMSA's input.
Another important thing to consider here is that in the
Security Directive, there's a separate paragraph that gives the
affected pipeline companies the opportunity to submit alternate
procedures and so if they have a way to do something better or
if they think there might be a second or third order effect of
the Security Directive that we might not have foreseen when we
issued the Security Directive, they can come in to us and
suggest an alternate way to achieve the same security outcome.
We review those requests relatively quickly and get back to
the operators. So there is some flexibility built in to ensure
that our intent for security outcomes is achieved without any
impacts that might be, you know, for example, an impact on
safety that we might not have seen. So there is flexibility
built into that process.
Senator Fischer. With that flexibility, have you seen any
concerns, have you heard of any concerns from these companies?
Are they taking advantage of that review?
Mr. Pekoske. They are, and we have heard of some concerns,
and we are willing, ready, and able to take their input with
respect to alternative procedures.
The important part of this, too, is that whenever we get
input, there's always a discussion as to why we decide to go
down a certain path. So I think the pipeline companies will
find this process to be one that their input is taken
seriously, fully considered, and they're given a reason why we
take the ultimate action we decide to take.
Senator Fischer. Can you share with us at this point in
time, without getting into too much details, some of the
concerns that have been expressed to you?
Mr. Pekoske. Yes, ma'am. I'll highlight two. One concern is
on the very aggressive timelines in the Security Directive and
we understand that. We do think that the security issue is
immediate and requires immediate action. So, you know, a common
concern was, hey, this is a fairly rapid implementation, can we
have more time?
The second concern was on have you thought about any safety
impacts? The answer is yes, but to the pipeline operators, if
you have more information to share with us on that, please do
so, and we will fully consider that and we will coordinate that
with PHMSA in providing a final reply.
So I think there will be a very good give and take back and
forth with the pipeline industry owners and operators and our
partner Federal agencies.
Senator Fischer. You know, as we look at the Security
Directive that was issued on May 27th, it required the
operators to review their current cybersecurity practices and
be able to identify the gaps and also look at remediation
measures and to report those results on the review to TSA, to
CISA within 30 days and so that would have been the end of
June.
The most recent Pipeline Cybersecurity Directive was issued
toward the end of July, on the 20th. To what extent did TSA and
CISA review the cybersecurity reports that it required from
pipeline operators in its May Security Directive and
incorporate any of those ideas?
Mr. Pekoske. Senator, a couple comments on that. The second
Security Directive did consider the input that we'd received
from the owners and operators of the first Security Directive.
I'm happy to tell you that we had a hundred percent
response from the critical pipeline security operators
identified in the first Security Directive. We received the
input on the gaps and how they intend to bridge the gaps in the
cybersecurity guidelines.
We are still in the process for some of them of reviewing
that and certainly if there's an impact on that on the second
Security Directive, that's something that we would take into
consideration.
Senator Fischer. You know, obviously we're very, very
worried about the risks that we face. So I look forward to
hearing from you on some of the information you received and
how you're responding to it.
Well, thank you. Thank you, Madam Chairman.
The Chairman. Thank you, Senator Fischer.
Senator Markey.
STATEMENT OF HON. EDWARD MARKEY,
U.S. SENATOR FROM MASSACHUSETTS
Senator Markey. Thank you. Thank you, Madam Chair, and
thank all of you for being here today.
We had a big explosion, pipeline explosion in Lawrence,
Massachusetts a couple years ago. Columbia Gas was the company,
and they had not done a good job at all in upgrading the
protections that they were building into their pipeline system
and the consequences obviously for ordinary families and
businesses in Lawrence and Andover, North Andover were
catastrophic.
Much of the lessons that were learned were built into a
pipeline safety bill passed through this committee last year
and is now the law in the country and I thank the Chairwoman
and I'm very proud of the provisions that were included that
reflect the lessons that we learned.
Of course, one of the lessons we learned is how much this
industry is just way behind the times. That was a company. That
was an industry that just hasn't kept up with the times.
So one of my questions is this, I asked the CEO of EMC up
in Massachusetts about seven or 8 years ago why don't more
companies just upgrade, you know, so they can protect
themselves against cybersecurity attacks, and what he said to
me was, ``well, it's because they just see it as a cost they
don't want to assume and they just cross their fingers and hope
that they're not going to get hit and if they do get hit
because the executives tend to be older, you know, it'll just
be on the shoulders of the next generation coming up and they
escape it.''
So to a certain extent I think the big question for me is
the protections are there, you just have to pay for them. Why
don't they pay for them? Do you agree with the CEO of EMC who
said that to me, that, in general, industry officials just
don't want to accept the cybersecurity protection as a cost of
doing business in the modern world and they're trying to
pretend that it's an older world and that perhaps they as the
executives can just escape the responsibility of paying for the
upgrades?
Mr. Pekoske. Thank you for the question, Senator, and I
have a couple comments with regard to that.
First, you're right, a lot of cybersecurity procedures are
simple. Cybersecurity hygiene items that have been well laid-
out to us as private citizens apply equally to companies.
Simple things, such as changing your password or using
multifactor authentication on bank accounts and things of that
nature.
That's why we relied back on the NIST standards for some of
our Security Directive work is, you know, it's an easy standard
to go to on the internet. It lays out best practices that
industries and people ought to be following.
Senator Markey. What happens when they don't want to follow
best practices, which they don't? They're there. This is not
brain surgery here. Everybody knows that this is a problem and
they've known it for 10-15 years. So it's not like the light
bulb is going off in these offices. They've already made a
conscious decision not to make the investments.
So if they don't adopt best practices, do we need a mandate
that they have to adopt best practices?
Mr. Pekoske. Well, and that's what the Security Directive
does require, sir. It puts a mandate in place for the most
critical pipeline systems to do some of those best practices.
I also think that the costs are going up for this. If you
look at Colonial Pipeline ransomware $4.4 million, you know, I
often think about if that $4.4 million had been invested
upfront in their system, what could have been done with that
fund.
Senator Markey. So a stitch in time saves nine because
there's almost an inevitability to a continuation of this and
it doesn't necessarily have to come out of Russia or Iran or
North Korea. It can come from anywhere, including just somebody
in the United States who has malicious intent.
Mr. Pekoske. Yes, sir, and in many of the ransomware
attacks, sir, are called ransomware as a service. Literally you
can buy the service to conduct a ransomware attack against a
target. So you don't even have to be sophisticated to do that.
Senator Markey. Yes. And it turns out you don't really have
to be sophisticated to buy the protections against it either.
Mr. Pekoske. That's correct.
Senator Markey. You just have to bring in the contractor
who will install the protections.
So what is the level of cooperation you're receiving across
the country on implementation of those protections?
Mr. Pekoske. Sir, the level of cooperation so far has been
outstanding. The first Security Directive, we've gotten a
hundred percent response. With respect to identifying the gaps
against existing cybersecurity guidelines, we have the
responses. We're still going back and forth with some of the
companies to get additional information to more fully
understand.
Additionally, they do now have significant resources on the
part of the Federal Government. The Cybersecurity
Infrastructure Agency and TSA both have resources to assist,
and I think the dialogue with the companies will get even
stronger with result of these Directives.
Senator Markey. OK. Well, I hope so because obviously
consumers pay a big price in increased costs for the energy
which they have to pay for because the companies are trying to
save money on the short run.
So I thank you, Madam Chair, and I thank all of you for
your good work on this issue.
The Chairman. Senator Blumenthal.
STATEMENT OF HON. RICHARD BLUMENTHAL,
U.S. SENATOR FROM CONNECTICUT
Senator Blumenthal. Thank you all for being here and thanks
for your great work.
I want to pursue Senator Markey's line of questioning. You
know, this idea of spurring more protective measures by the
private sector has been an idea here for some time, probably
the better part of 5 years, maybe a decade. I remember talking
to Senator McCain and Senator Kyle about efforts that could be
undertaken and what we encountered was a resistance to taking
action and also to reporting.
Have you found that there is more of an inclination to
report instances of cyber attacks now than before? Obviously to
some extent yes, but are they really reporting as fully as they
should be? Let me go down the table.
Mr. Pekoske. Senator, yes, they are reporting more than
they have in the past. The first Security Directive we issued,
the first thing it requires is reporting for significant
incidents because we wanted to get a baseline of information as
to what was going on and I think it's also good for the
industry partners to see, hey, I'm not alone here. Some of my
other companies are experiencing the same thing. We need to get
at this. So I expect the reporting to continue to be robust. It
will certainly help us.
Senator Blumenthal. Are those reports made public?
Mr. Pekoske. No, sir.
Senator Blumenthal. Why not?
Mr. Pekoske. The raw data will not be made public but
summary data will be made public.
Senator Blumenthal. Why not make the raw data public?
Mr. Pekoske. For proprietary reasons for companies they
might not want to reveal some vulnerabilities that we have.
What we're interested in is we will know that, CISA will know
that, and just to provide kind of a baseline across the
industry that says, hey, across the pipeline sector, for
example, there have been X number of ransomware attacks over
the past 30 days and we might highlight in general terms what
the nature of those attacks were to provide information we
think others need to have to prevent them from happening to
those other companies.
Senator Blumenthal. I think one of the reasons there isn't
more reporting is that there isn't more reporting. In other
words, the public isn't aware of reporting. The companies feel
the public isn't aware of reporting. So when there is
reporting, it seems like an isolated more embarrassing
incident.
If there were more reporting, first of all, the public
would become more alarmed as it should be and companies might
be more inclined to actually report because they would see it
as something that is common and should spur action.
I don't see--I mean, I can understand the proprietary
interest, but I don't know how that would prevent more fully
reporting the actual dimensions of this threat to our country
because, you know, the attackers are aware. Nothing that would
keep it from them. They're aware of what they're doing. The
companies are aware of it. You're aware of it. The ones who
aren't aware of it are the American people. Shouldn't they be
better informed?
Mr. Pekoske. Yes, sir, I agree they should be better
informed, and we do have a responsibility to do that. I was
just really referring to the specificity of the attack.
I think providing information that the public can use to be
informed as to the scale of what's going on and hopefully over
time the trend of having fewer and fewer of these type of
incidents will be important.
Senator Blumenthal. Could you send to us, to me
information, I assume it's compiled and you can make it
available to us in some form, that maybe is nonspecific as to
who the company is and then we can follow up as to whether or
not the names of the companies could be revealed?
Mr. Pekoske. Yes, sir, be happy to work with your staff on
providing that information.
Senator Blumenthal. I would appreciate that. And if you had
to advise a company as to how to report, what would be your
advice?
Mr. Pekoske. My advice to a company in terms of reporting
cyber incidents would be to report to CISA and we provide in
our Security Directive that reporting link so it's very easy to
do.
The other thing I think we have a responsibility on the
Federal side, whether it's PHMSA, TSA, CISA, or the FBI, when
any one of us gets a report to share it with the others
because, you know, I don't want to have companies trying to
figure out where to report. I want them to report so that we
can put it together.
Senator Blumenthal. But would you ever advise a company to
try to deal with it on their own without----
Mr. Pekoske. I would not, sir.
Senator Blumenthal. OK. Thank you. Thank you, Madam Chair.
The Chairman. Senator Blackburn, are you ready to go or if
not,--OK. Senator Blackburn.
STATEMENT OF HON. MARSHA BLACKBURN,
U.S. SENATOR FROM TENNESSEE
Senator Blackburn. Yes, indeed. And thank you all. We
appreciate your being here and the attention to the issues.
I will have to tell you when I was reading testimony last
night, even though it came in late, but reading testimony I
feel like there's a little bit of kick the can around on who's
responsible for what.
I've talked to some of our pipeline companies in Tennessee
and they are very worried about the new requirements in our
second Security Directive that you all have put out and,
Administrator, this is to you.
They say that the Directive could require them to replace
thousands of pieces of equipment all over the country. Not only
would it be expensive, take a long time, supply chain shortages
are an issue.
So what are the options for the companies when these new
Directives are going to be not feasible to achieve?
Mr. Pekoske. Senator, if a company feels the new Directive
is not feasible, the first thing they should do is contact us
so we can have a discussion on why they feel that way and what
specifics they have.
Senator Blackburn. OK. And so how long would it take for
those alternative action plans to be reviewed and accepted?
Mr. Pekoske. Sometimes they can be relatively quick, a
matter of days. Other times they're more complex, and what
we're trying to do is figure out security outcome equivalency.
Sometimes that's a little bit more complex to do, but there's a
dialogue ongoing as soon as they submit it.
Senator Blackburn. So you are looking at this as a
directive and not a mandate?
Mr. Pekoske. The Directive has mandates in it. The way we
look at it is if a company has a different way of doing
something that achieves the same security outcome,----
Senator Blackburn. So you have flexibility?
Mr. Pekoske. They have--they can apply for an alternative
procedure and we will review that with them.
Senator Blackburn. OK. Let's talk a little bit about the
cyber threats and one of the things I hear from companies,
whether they're large, mid-size, or small, is inconsistencies
in the toolbox that would allow them to move forward. Here's a
process, here are tools that are available to you, and it's
going to be different.
So you look at a company like Microsoft or Colonial
Pipeline or a small business that is doing military contracting
in Tennessee. So what tools should they have in the toolbox?
What should you be making available to them?
Mr. Pekoske. Senator, many of the tools are available
commercially to them. What I would suggest is that they look at
the standards that we have in the Security Directive and the
standards that NIST has set for cybersecurity. It's called the
Cybersecurity Framework and they have some publications. That
gives the criteria upon which they can measure whether a
commercial provider can meet the requirements.
Senator Blackburn. So there is a variety of sources and not
a one-stop shop?
Mr. Pekoske. Correct.
Senator Blackburn. OK. Is it a goal of any of you at the
table to bring this together in a one-stop shop that would be
more helpful to these companies, especially smaller business
companies that are doing contracting with some of our critical
infrastructure?
Mr. Pekoske. Well, Senator, the requirements are not very
different. In other words, if there's a requirement for a
multifactor authentication of accounts, for example, that's
fairly straightforward.
What I was suggesting is there are different sources of
assistance that companies can access to meet that standard. So
it's not a different varying degree of security. It's the
security standard. There are different ways to get to it.
Senator Blackburn. Right. The difference, I think, here is
that you all know where these items are to be found, these
directions are to be found. Many times a business does not and
they turn for that guidance and if it is complicated to find
the guidance, then compliance becomes not only complicated but
costly.
We want to help and do our part in making certain the
proper prevention and response mechanisms are there, but it
means you all have to not play kick the can but you have to say
be more precise in your guidance.
OK. Let me ask you about this. In your testimony, you said
this that ``TSA has yet to identify or develop data sources
relevant to threat vulnerability and consequence of security
threats,'' and GAO made this recommendation to TSA in December
2018, but it had not been implemented as of last month.
So am I correct in understanding that TSA implemented two
new Security Directives without all the relevant data?
Mr. Pekoske. Senator, the GAO identified 15
recommendations. We concur with all the recommendations. We
implemented 12. Three remain outstanding, including the one
that you referenced.
Just because a recommendation is outstanding does not mean
we haven't done substantial work toward it.
Senator Blackburn. But do you have--did you have full and
complete data?
Mr. Pekoske. We had as full and complete data as we could
at the time we issued the Security Directive. We really
oftentimes never have full and complete data. That's very hard
to achieve. We need to move fast to close a security gap with a
system that's vital to U.S. national security and so we used
the best data that we had.
But I agree with GAO's recommendation and we are working
very hard on that.
Senator Blackburn. OK. I know I am out of time. Ms. Gordon,
I think you wanted to respond to that.
So, Madam Chairman, I will ask for her response in
writing----
The Chairman. Thank you.
Senator Blackburn.--in the interest of time. Thank you.
The Chairman. Thank you. Thank you, Senator Blackburn.
Senator Capito.
STATEMENT OF HON. SHELLEY MOORE CAPITO,
U.S. SENATOR FROM WEST VIRGINIA
Senator Capito. Great. Madam Chair, thank you. Thank you
for being here.
Not only do I wear a hat in terms of being able to serve on
this committee, I also am the Ranking Member on the
Appropriations Committee for Homeland Security, which
appropriates dollars for CISA. So I know they play a big role
here and we talk.
I think in the report there is a lot of talk about
collaboration and coordination between TSA and you've already
mentioned CISA in your responses.
Are we finding--did we find--I guess this would be for Ms.
Gordon--in the examination, have we found that these
coordinations are occurring and collaborations are occurring?
Are we falling short here? Is there a better way that we can
manage that, I think, particularly important aspect of trying
to prevent cyber attacks?
Ms. Gordon. Thank you, Senator.
In our work that dates back to 2019, we had a number of
recommendations to affirm and encourage PHMSA and TSA to
collaborate and coordinate better. To date, they have addressed
four of the five recommendations that we had.
The one that remains outstanding is about the Incident
Recovery Protocol Plan and more information is needed to fully
develop and update, actually update that plan so that it
accounts for security risks, threats, changes in Federal law
and policy, and TSA has reported back to us that it's working
on that and collaborating with PHMSA to do so.
Senator Capito. Great. Thank you.
Mr. Administrator, it's good to see you again. Let me ask
you this. None of Colonial Pipeline's operational technology
was impacted by DarkSide hack. However, there is still a
concern that the hackers have obtained information that can
still remain a possible impact to Colonial's operation.
Does possession of such information pose a threat to their
current operations as you know it or has Colonial worked with
TSA to resolve any of these risks and give me the status update
on that type of the information that they may still have or may
still be out there.
Mr. Pekoske. Thank you, Senator. Good to see you, as well,
and we work very closely with Colonial as does CISA and the FBI
and the Department of Energy.
They brought on private sector and third party companies to
help them recover from the ransomware attack and so I know
they're working with those companies to assess the extent of
the impact, the long-term extent of the impact on their
business.
Senator Capito. So that's an ongoing investigation?
Mr. Pekoske. It is.
Senator Capito. It is. I think a lot of the cyber attacks
that you hear, both government and private sector, occur very--
I don't want to say innocently but the ability to get into the
systems occurs by human error. Somebody opens an e-ail,
somebody inadvertently, you know, makes it easier to breach the
systems.
What's the key to--I guess training is the key to keep--on
a preventive measure to make sure that everybody realizes the
ramification of doing that.
Do you have any other perspectives? This would be for the
whole panel. Any other perspectives on how to cut down on that
human error, a simple mistake can cause a major breach? I don't
know who wants to start. Mr. Administrator, why don't you
start?
Mr. Pekoske. Thank you, Senator. A couple things. One is
you're right, training is a key part of it. The other is I just
think greater cybersecurity awareness on the part of leadership
applies in the government, applies in the private sector, as
well.
Long gone are the days when you're a senior official in the
private sector or in government where you can say, hey, I don't
understand that stuff because it impacts your ability to
operate as an agency and your ability to operate as a private
sector company.
Some of the requirements in the second Security Directive,
which I can't discuss in detail because they are sensitive
security information, do provide the information that will
allow us to see and the companies to see whether or not they
might have some breaches in their IT infrastructure that they
ought to take a look at.
Senator Capito. OK. Ms. Trottenberg, I think maybe also I
may be interested to hear what the Department of Transportation
is doing as preventative measures for the things I was talking
about.
Ms. Trottenberg. Thank you for the question, Senator, and
just to echo the Administrator's comments, I think we see
certainly across the transportation sector a lot of the cyber
risk is for sort of very basic cyber hygiene issues, that there
are obviously some very sophisticated attacks happening at high
levels, but a lot of it is fairly basic, and I think TSA
Security Directives are hopefully going to really buy down that
risk.
You know, as I stated earlier, we are just seeing in the
transportation sector obviously as systems grow more
sophisticated, the pipeline system, the vehicle systems, that
there are more points of vulnerability and I think as the
Administrator said, it's no longer just sort of the IT
department that has to worry about this. The whole leadership
of the organization needs to be involved in cybersecurity.
Senator Capito. Right. I mean, if you're looking at
vehicles, you know, with all the different sensors going just
over a bridge or something, the ability to disrupt is going to
be, I think, I agree, more and more.
Ms. Gordon, did you have anything you wanted to add there?
Ms. Gordon. The Department of Transportation, the
Department of Homeland Security serve as the sector risk
management agency, lead agency around security for the
transportation sector. They have a role to educate, to provide
information, to share information about threats to their
private sector populations and the private sector owner-
operators and that's a vehicle they can use to raise awareness
and educate.
Thank you.
Senator Capito. Thank you, Madam Chair.
The Chairman. Thank you, Senator Capito.
Senator Rosen, thank you for being so patient. I think I
was supposed to call on you and I missed you when I called on
Senator Blumenthal. So I think you're back online and very much
appreciate your input.
STATEMENT OF HON. JACKY ROSEN,
U.S. SENATOR FROM NEVADA
Senator Rosen. Thank you. Thank you, Madam Chair.
You know, technology is great when it all works and my
microphone wasn't and so we're here today to talk about
technology and it's great when it works. It's great when you
know how to use it. It's great when you're trained to use it
and that you're hyper-vigilant about it as it comes to the area
of security, as many of my colleagues, everyone has been
discussing the TSA, the Security Directive that was just issued
last week, and so I have a few additional questions building on
what's already been discussed so far.
So, Mr. Pekoske, does the Directive detail specific
safeguards, specific safeguards that pipeline owners and
operators should be taking to prevent those ransomware attacks
and, if so, can you share those or you can tell me we can take
them offline but can you give us a broad perspective of that?
Mr. Pekoske. Senator Rosen, thank you and, yes, it does
have some very specific requirements that the owners and
operators of these most critical pipeline systems need to
follow.
I really can't discuss them in great detail in this venue,
but I would be most happy to take them offline with you, but
very broadly, if you look at the NIST Cybersecurity Framework,
it's posted on the NIST website, we reference it in the
Security Directive, that will give you an idea of some of the
items that we require in the Security Directive.
Senator Rosen. Thank you. That's great. I'd like to ask
this other question building on that.
Does the Directive include penalties for companies that
fail to comply and, if not, how can you at TSA ensure that the
Directive is effective if there is no way to enforce it?
Mr. Pekoske. Senator, there is a penalty, a civil penalty
assessed for each incident of noncompliance. The Directive has
the force of a regulation and so there are penalties attached
for noncompliance.
Senator Rosen. And I know you probably answered this, but I
just want to be sure that the Federal Government, TSA, that you
are, that we are providing guidance to companies to ensure that
they're able to quickly implement these mitigation measures,
such as the NIST standards and other things as outlined in the
report, multifactor authentication.
They're often complex and they take time and so people do
need guidance. Are you providing that?
Mr. Pekoske. Senator, that's a key part of our mission is,
you know, it's very different to require things and not
collaborate either before the fact or during implementation. We
want to do both and so we collaborated before the fact.
We want to be very good partners with the owners and
operators of these pipeline systems because our collective
objective is to make them more secure from cyber attacks.
Senator Rosen. Thank you. I appreciate that.
I want to move on to my Cyber Sense Act because the
Colonial Pipeline attack just was a stark reminder that our
critical infrastructure is such a target.
So I recently reintroduced the Cyber Sense Act. It's
bipartisan legislation that would create a voluntary Cyber
Sense Program at the Department of Energy to test the
cybersecurity of products and the technologies intended for use
in the bulk power system.
This bill would also direct the Secretary of Energy to
consider incentives to encourage people to use analysis and
testing results when they're designing their products and
technologies.
So, Mr. Pekoske and then Ms. Trottenberg, while this
program that I'm talking about in my Cyber Sense Act is for
energy companies, do you think a similar program for other
critical infrastructure, such as pipelines, would be helpful
for the pipeline owners and operators and so, Mr. Pekoske, you
can begin, please.
Mr. Pekoske. Senator, one of the things that we are very
carefully looking at is, you know, we put Security Directives
out to make cyber measures much stronger on pipeline systems,
the most critical pipeline systems, but there are other
elements of critical infrastructure and some of these
cybersecurity requirements can apply across elements of
critical infrastructure. So that's part of the work that we
have in front of us is to see what can apply more broadly
rather than into a specific sector.
Ms. Trottenberg. I'll just sort of echo the Administrator's
comments. Obviously I think what we're seeing with the Security
Directives and the pipelines a lot of good work has gone into
them, a lot of collaboration with industry across the
transportation sectors.
There are clearly other sectors that it's going to
logically follow. We've mentioned vehicles today. So I think
there will be opportunities, I think, for further collaboration
with you all and with TSA.
I think we want to make sure that we're seeing robust cyber
protections starting to be instilled in at least all the
industries across the transportation sector.
Senator Rosen. Thank you. I only have a few seconds left.
So I'll take this answer off the record, but I would like to
have your views on how we invest in cyber personnel and
technologies in the workforce pipeline because we can't do any
of this work without people trained to do it and so I just want
to know your opinions and how we can support companies to
invest in developing the personnel that they need and those
resources, and again I see my time's expiring. So I will just
take those off the record.
Thank you for your time here today.
The Chairman. Thank you, Senator Rosen.
Senator Tester, are you ready?
STATEMENT OF HON. JON TESTER,
U.S. SENATOR FROM MONTANA
Senator Tester. Always ready. Thank you, Madam Chair.
I want to thank everybody that's here to testify. This is
really an important hearing for critical infrastructure
everywhere. I mean, I'll probably focus on the Colonial
Pipeline, of course, but the truth is the attack on JBS and all
the attacks that I don't know about that have gone on.
So the real question here is when we have critical
infrastructure like the Colonial Pipeline, what should be
required of that company when it comes to having an attack on
critical infrastructure? How broad-based reporting--this is for
you, Mr. Pekoske.
How much information should they be required to give to the
FBI and CyberCom and all those folks?
Mr. Pekoske. Thank you, Senator, and in the first Security
Directive we do require that companies report to CISA and CISA
will distribute to the other agencies as needed, any
significant cyber event and then we define what significant is
because----
Senator Tester. Are there timelines when they have to
report it by a certain time?
Mr. Pekoske. They do, yes, sir.
Senator Tester. What is the timeline?
Mr. Pekoske. I believe it's 24 hours. So it's very quick.
Senator Tester. All right. And is it just a report or do
they have to do more than that?
Mr. Pekoske. Yes, sir, there's detail required in the
report and then, of course, you know, depending on what's
reported and the severity of the incident, there will always be
follow up with CISA and other partners.
Senator Tester. There's a bill out there, was it 2407,
2407. Are you familiar with that bill? It's a bill on reporting
requirements. Is that a yes?
Mr. Pekoske. I don't know the contents of the bill, sir,
but I will certainly look at it.
Senator Tester. OK. Are any of you familiar with 2407? No,
not so much.
Well, I'd ask that you take a peek at it. It is a bill that
delineates out the reporting requirements. Look. I'm all for
privacy, but when it comes to critical infrastructure, I think
that's called critical for a reason and they need to open their
books to make sure that we have the information.
So we know about Colonial. We know that the folks who
attacked it have ties to Russia. We also recently learned that
China was responsible for an attack on over 20 pipeline
operators a decade ago, eight to 10 years ago.
So what additional resources do agencies need to adequately
prepare for any possible attack by any foreign actor but
particularly when it comes to Russian and China actors?
Mr. Pekoske. Sir, additional resources, I think, would be
particularly helpful in doing things that kind of raise the
baseline of knowledge. For example, resources to support
additional training, additional workshops, additional
exercises.
There's nothing like a real-world exercise that can be a
sobering experience that will cause people to step back and
say, OK, there could be some real impacts here, I need to
invest more in my own cybersecurity.
The other part, too, if I could briefly, is to embed and we
look at this very carefully as does CISA, to try to embed
resiliency in some of these systems so that if you are attacked
and that may happen,----
Senator Tester. Yes.
Mr. Pekoske.--it may not be preventable, you've got some
resilient----
Senator Tester. So from a TSA perspective, you have
everything you need right now to deal with the issue of cyber
attacks?
Mr. Pekoske. Sir, so we have dedicated a good number of
additional resources in cyber. I don't think we're at the point
we have everything that we need.
Senator Tester. So could you do me a favor?
Mr. Pekoske. Mm-hmm.
Senator Tester. If you don't have everything that you need,
could you get a list to the Chairman and the Ranking Member and
myself of what those extra things are that you might need?
Mr. Pekoske. Yes, sir.
Senator Tester. I'm not saying we're going to do it, but
the truth is, is if there are gaps we need to know what those
gaps are so that we might be able to address them either
through appropriations or through policy.
Mr. Pekoske. Yes, sir.
Senator Tester. Appreciate that. Thank you, Madam Chair.
The Chairman. Senator Hickenlooper.
STATEMENT OF HON. JOHN HICKENLOOPER,
U.S. SENATOR FROM COLORADO
Senator Hickenlooper. Thank you all for your time and your
service, appreciate it. This is certainly one of the most
critical issues facing the country when you look across the
entire landscape.
I have a statement here. ``A fully prevented cyber attack
causes no damage at all.'' I would argue that's probably
mythical. There's no such thing as fully prevent. I guess you
count on some occasions but even when you have what some would
call perfect defenses, it's a moving target, and I think that
backups and recovery plans are achievable if they help mitigate
the damage and I think they reduce the pressure for paying
ransoms, such as we saw with Colonial.
Administrator, what extent do the TSA pipeline security
guidelines include prioritize these resiliency measures, that
back side?
Mr. Pekoske. Thank you, Senator, and that's really a key
critical part of our effort is to make sure that, you know, you
can't do everything all at once. You've got to be able to
prioritize.
We do this extensively in aviation security. The GAO did a
review of our risk prioritization, made some recommendations
for us, which we are in the process of implementing, but you
hit the nail on the head.
I mean, the idea is to mitigate the risks as much as you
can and then understand where you might have some residual risk
left, but as I mentioned with Senator Tester, a key part of
that whole equation then is to understand what the resiliency
is where you have unmitigated risk, as well.
Senator Hickenlooper. Got it. And I guess I could ask all
of you this. When I was Governor, we spent a lot of time
looking at how to value risk management from the point of view
of state, local, Federal partners. We created something called
the National Cybersecurity Center in Colorado Springs which
really focused on providing cybersecurity expertise to local
leaders, municipal leaders, county commissioners, state
leaders, making sure they have education outreach up and down
the chain of command within states.
Why don't we start with you, Administrator? How do you
believe that TSA can improve the coordination and information-
sharing that's necessary up and down--from state to state but
also especially vertically within states?
Mr. Pekoske. Sir, and that's one of those topics where you
can make a number of improvements and you can also say at the
very same time much more work needs to be done, and I applaud
the initiative of having cybersecurity centers that are spread
throughout the country and one of the things I think is really
important about those centers, you mentioned the ability to
train leaders and I think particularly when it comes to
committing investment to close cybersecurity gaps, it needs to
be the leaders of private sector companies and leaders of
public agencies and organizations that kind of understand when
somebody comes to them and says, hey, I need to get this amount
of resources to close this gap, understands why that's so
important.
Senator Hickenlooper. Right. Either of you other want to
take a shot at it, a swing?
Ms. Trottenberg. I'll just add a couple things, Senator.
First of all, I think, you know, one thing in what I hope is
the deepening relationship between DOT and TSA, I think one of
the useful things we bring to the table, as you know well, is
on the transportation side very close relationships with state,
local government transportation agencies, and I think we're
trying to increasingly, you know, again within our authorities
and our capabilities, help them think through some of the cyber
issues they're facing and work closely with TSA on that front.
Just to go back to your original question on sort of
mitigations, I think one of the interesting lessons of Colonial
Pipeline is PHMSA stood up and helped Colonial Pipeline do
manual operations, something that they had not done for many,
many, many years, and now one thing we're going to be looking
at going forward with pipeline operators, can you get up and
running manually should an incident occur, so we can be sure we
don't have those disruptions.
Ms. Gordon. As GAO has reported on the cybersecurity needs
for the Federal Government, there is a need for a comprehensive
Federal cyber strategy with the appointment and approval of a
national cyber director. This is a focused person in a role and
responsibility and now there's a need to update the Federal
cybersecurity strategy.
I think when that is updated, then the sector risk
management agencies can help in coordinating down to the state,
territorial, tribal, local levels.
Senator Hickenlooper. And do we think that that's going to
get us to another mythic proportion, that single point of
contact with the Federal Government? I know that's been an
issue for many Governors and hence probably Senators, as well.
I mean, where do you connect with the Federal Government on
these issues?
Ms. Gordon. The sector risk management agencies for each
sector.
Senator Hickenlooper. About how many of those?
Ms. Gordon. There are nine.
Senator Hickenlooper. Nine. I stand corrected. All right.
Ms. Gordon. CISA's always the place to go for cybersecurity
information, of course.
Senator Hickenlooper. Got it. All right. Thanks. I'll yield
my time back to the Chair. Thank you.
The Chairman. Senator Scott, are you ready? Senator Scott
and then Senator Warnock.
STATEMENT OF HON. RICK SCOTT,
U.S. SENATOR FROM FLORIDA
Senator Scott. Thank you, Chair.
Thank each of you for being here. Thank you for your
service.
Do we all agree that the actions--if you look at the
actions of Communist China, they're becoming increasingly
dangerous and a bigger threat possibly to American cyber-
security. I think we all agree with that, right?
[Witnesses nodding their heads.]
Senator Scott. Anybody think they're going to get any
better? So what can we do to get government, especially the
Federal Government, and the private sector to start working
together better to make sure that we don't have these
ransomwares and we have worse attacks going forward? What would
you all--what's your suggestion?
Mr. Pekoske. Senator, I think one of the key things is to--
this is a partnership. The government cannot protect alone
private sector-owned infrastructure that might be subject to
attack from a nation state and so I think the increased level
of coordination and cooperation and partnership between the
government and the private sector is really important.
We have always done that in the aviation side and we do it
now, now that we've regulated, surface transportation security
in terms of two Security Directives. That give and take and
that back and forth is very important for our mutual success.
Senator Scott. Any other suggestions?
Ms. Trottenberg. I think I'll just add to what the
Administrator said. The aviation is a good model where
obviously there has been a very close nexus between FAA, TSA,
and the private industry. It's starting to develop now in
pipelines to a greater degree obviously driven in part by the
Colonial Pipeline cyber attack, and I think you'll see that
will continue to grow across other sectors.
I think we're finding a good template of bringing private
industry in, working collaboratively. I think as the
Administrator says, neither side can do it all on its own. Both
sides are going to have to bring their resources to the table.
Senator Scott. Yes. Good.
Ms. Gordon. There are a number of models in how we work
with the private sector and the Federal Government. In critical
infrastructure, there's the CFAS Program which is a little more
of a regulatory model but it uses performance standards in
order to bring private sector into meeting specific standards
but allowing them to do it the way that they feel best meets
those standards. They just are measured against meeting
standards. It's also a risk-based approach.
There's a different regulatory model in the energy sector
and we see a change here with the May and July Security
Directives that TSA has put out moving from a voluntary
partnership model to a little more of a regulatory stance in
the transportation sector.
Senator Scott. Do you think we need to have--the private
sector needs to disclose to the proper Federal agency when they
have an attack, and do you believe it ought to just be to the
Federal agency? Do you think it ought to be to the public? Do
you think there ought to be more disclosure about, you know, if
they're paying ransomware, things like that?
Mr. Pekoske. Senator, the first Security Directive we
issued at the end of May requires exactly that reporting. It's
reporting of all significant cyber incidents and we define
significant. So we're not looking at some very minor issues
that are going on every single day in every company but really
the most significant ones, and then from our perspective, it's
important for us to share generally that information so that
the American public kind of understands the baseline of cyber
activity.
Senator Scott. Do all of you agree on disclosure or what's
your thought process? Do you think it ought to be to the public
or just to a Federal agency?
Mr. Pekoske. So the reporting is to the Federal agencies
and there will oftentimes be company proprietary information in
that reporting, necessarily so, so that the Federal agencies
that are trying to assist fully understand the scale and the
scope of the attack.
I think the Federal agencies have a responsibility to
anonymize that data and provide it in general format to the
public.
Senator Scott. So are there best practices that we ought to
be--whether it's dictating, but best practices that we ought to
be telling the states and local governments what they ought to
be doing?
Mr. Pekoske. Yes, sir, and a number of those best practices
are embedded in the Security Directives, but for the states
that don't have the Security Directive, I would refer to the
NIST standards, the NIST Cybersecurity Framework, which is
excellent.
Senator Scott. OK. Thank you, Chair.
The Chairman. Thank you, Senator Scott.
Senator Warnock.
STATEMENT OF HON. RAPHAEL WARNOCK,
U.S. SENATOR FROM GEORGIA
Senator Warnock. Thank you, Madam Chair, for hosing this
conversation on Pipeline Security: Protecting Critical
Infrastructure.
Obviously this is an issue that all of us are concerned
about. We've been able to see really just a glimpse of the
potential consequences. I say that as someone who hails from
the state of Georgia. Colonial Pipeline, of course, runs
directly through my state.
Following the ransomware attack on Colonial, over 40
percent of the gas stations in Georgia were out of gas. At the
height of the situation, over 70 percent of the stations in the
Atlanta area were without gas. This attack caused a lot of
turmoil to put it lightly in Georgia and across the country.
Folks couldn't go to work, small businesses suffered,
families in Georgia who were already barely getting by had to
deal with another crisis after a challenging year. Ransomware
attack on the Colonial Pipeline had very real consequences for
working families across Georgia and exposed obviously national
security concerns, dangerous vulnerability in our critical
infrastructure.
Administrator Pekoske and Deputy Secretary Trottenberg, my
first question is simple. What specific steps are your agencies
taking right now to prevent a cyber attack like this from
happening again? Administrator Pekoske?
Mr. Pekoske. Thank you, Senator. We've taken two very
specific steps recently.
We issued two Security Directives which basically are
regulations that are implemented in an emergency to require
action on the part of private sector entities. The first
Security Directive required reporting, required the
establishment of a cybersecurity coordinator that was available
24/7, and also required private sector pipeline companies to
assess their cybersecurity against the cybersecurity guidelines
that we had published in coordination with them for many years.
The second Security Directive has specific actions to
ensure that the companies increase their overall cyber-
security. Those specific actions are sensitive security
information, so they're not public, but the whole idea behind
the second Security Directive is to make sure that, in addition
to the reporting and the coordinator and the gap analysis, that
we take specific actions to prevent an attack from occurring.
Additionally, the second Directive requires something
called the Architecture Design Review and the purpose of these
architecture design reviews is to take a look at the IT
architecture of a company and determine whether or not a
business IT system might bridge into an operating technology
system which could in the case of a pipeline affect the flow of
product through that pipeline and so we want to just make sure
that there is good separation between those two systems.
Additionally, we have a requirement in the second Security
Directive for some contingency planning on the part of pipeline
companies. When I say pipeline companies, these are the
pipeline companies that are the most critical, not all pipeline
companies, and the ones that account for about 85 percent of
the product that flows in the country.
Senator Warnock. Deputy Secretary Trottenberg.
Ms. Trottenberg. Yes, thank you, Senator. DOT through PHMSA
is regularly inspecting and regulating pipeline operations
around the country. We're inspecting the physical integrity of
the pipelines. We're in control rooms and so we are looking for
where we see security issues and working closely with TSA and
CISA on that and I think one lesson I was mentioning to Senator
Hickenlooper, as a mitigation plan, we're also making sure, as
Colonial had to do quickly, in the case of the cyber attack,
can you manually operate your system so that you don't see the
kind of disruptions that you saw on the ground in Georgia and
other states if there is some kind of an attack.
We're wanting to make sure that now operators have those
mitigation plans in place and, as always, other parts of our
agency, particularly Federal Motor Carriers and MARAD, are
working with local governments and state governments on the
ground if there are cases where we see issues with fuel
deliveries and shortages, making sure we can get trucks and
ships delivery.
Senator Warnock. Thank you. As we focus on preventing
future major cyber attacks, I think that some of the work
that's happening in the state of Georgia can be helpful in
these efforts.
I'm particularly proud that our colleges and universities,
like Augusta University and Columbus State University, have
made the forward-thinking decision to invest in cyber
education.
Ms. Gordon, why is increasing the STEM and cyber education
of our young people critical to addressing gaps over the long
term and cybersecurity expertise in the TSA workforce,
including TSA employees who perform cyber-security inspections?
Ms. Gordon. Senator, there is a great need to increase the
cybersecurity workforce, not just in the TSA but in other areas
of the Federal Government, and the pipeline of educated,
dedicated individuals who are willing to work in the Federal
Service and apply their cyber-security knowledge base is
greatly needed.
Senator Warnock. Thank you all so much for those responses
and I look forward to working with my colleagues on this
committee and here in the Senate to make sure that we have the
kind of cybersecurity resilience necessary for this moment.
Thank you, Madam Chair.
The Chairman. Thank you, Senator Warnock.
Senator Lujan, are you available?
[No response.]
The Chairman. Senator Peters.
[No response.]
The Chairman. We have a vote ongoing and so I'm not sure
how much we're going to be able to fit in but while we're
looking to see if there are any other members who want to
participate, I wanted to--Senator Blackburn had brought up this
question which was to you, Acting Director Gordon, about in
your testimony you state that ``TSA has yet to identify or
develop data sources relevant to threat vulnerability and
consequences.'' I think that was a quote she was reading.
GAO had made this recommendation to TSA in December 2018,
but it had not been implemented as of last month. Am I correct
in understanding that TSA implemented two new Security
Directives without the relevant information about possible
threats to the pipelines in the USA?
Ms. Gordon. I would like to clarify our open
recommendation. It isn't that the TSA doesn't have information
on threat vulnerabilities and consequences. It's that our
recommendation is that they seek beyond just the information
they collect from owner-operators to other data sources and
bring in things like the information that PHMSA has about
pipeline physical conditions as well as prior cybersecurity
attacks and the like. So bringing in additional data sources to
account for when they are prioritizing and using the relevant
ranking tool to inspect a pipeline.
The Chairman. Any other witnesses want to comment on that?
Mr. Pekoske. Senator, I agree with Director Gordon's
comment. You know, we are very cognizant of the threats. It's
making sure that we import, as she said, as much additional
data as we possibly can, but I'm very confident in the pipeline
companies that we covered under our Security Directive that we
do have the most critical companies within that list and, you
know, I think we'll continue to improve our risk assessment/
risk management tool, but clearly we're very clear about the
threat that we face.
The Chairman. I think, Ms. Gordon, though, is saying that--
she's saying that you could be more--there's nothing to the
recommendations that you had to be limited.
Look. I think this has been greatly illuminating in so many
different ways. Again, we appreciate everybody being here, but
I think these are asymmetrical threats and let's face it. You
represent bureaucracies and as much as I want to see people
coordinate, the issue is you got to flatten the bureaucracy.
You got to flatten the bureaucracy and you got to get a game
plan and you got to implement new technology and you got to get
it done fast and so I would hope that we would all take heed of
the incident that happened and say what is that now that gives
us that ability to act in a more robust way than we're acting?
So everybody's competent here. Everybody's working hard.
Everybody, but something big has changed, OK, in that these
threats are very, very asymmetrical and it's not an advantage
that we're hierarchical. It's not an advantage.
So we've got to get out of these little silos that, you
know, are cozy for us and get the information and data and push
our colleagues and push the windows out of this bureaucracy
approach and get something implemented that is going to help us
all.
So I think the data is there and again I appreciate my
colleagues in FERC making, you know, their efforts known in
this.
So I hope maybe we could have another hearing on this in
the very near future on exploring some of those technology
solutions that we should be implementing and how we can get
them implemented faster because I really think that's where we
are. I think that this is, you know, going to continue to be
one of the biggest challenges that we face just because we live
in an information age and the threat by state actors as well as
people who just want to make money off of this are going to
continue and I think, you know, with a little more, you know,
discussion, breaking down these silos, I think we can get to
some solutions and get them implemented faster.
So thank you all very much for being here. The hearing
record will remain open for one week and any Senators that
would like to submit questions for the record should do so
within that one week.
And this concludes our hearing today. Thank you.
[Whereupon, at 11:48 a.m., the hearing was concluded.]
A P P E N D I X
Response to Written Questions Submitted by Hon. Maria Cantwell to
Hon. David P. Pekoske
Colonial Pipeline Attack. In TSA's first Security Directive issued
in May, you required critical pipeline owners and operators to identify
any gaps and related remediation measures to address cyber-related
risks in their system and report the results to TSA within 30 days.
Question 1. What were the results of that report, and were there
common themes identified across critical pipelines that were similar to
the Colonial Pipeline attack?
Answer. As required under the Security Directive, pipeline owner/
operators were required to conduct a vulnerability assessment on their
Information and Operational Technology systems and identify any gaps.
Generally, based on the self-assessment responses provided by
applicable owner/operators, the common gaps noted including needed
improvements to pipeline operator security plans, configuration
management, incident response, continuity of operations, and
participation in cybersecurity response and recovery exercises.
Question 2. Prior to this attack were there any concerns raised
about potential cyber vulnerabilities for Colonial Pipeline?
Answer. TSA has conducted Corporate Security Reviews (CSRs) and
Critical Facility Inspections/Critical Facility Security Reviews
(CFSRs) with Colonial Pipeline. The results of these reviews are
protected from disclosure as Sensitive Security Information.
TSA Security Directive #2. On July 20, 2021, TSA issued a Security
Directive that required the 100 most critical pipeline owners and
operators to take specific action to enhance the cybersecurity of
critical pipelines. However, in the natural gas industry there are
1,344 distribution pipeline operators, 165 transmission pipeline
operators, and 382 natural gas gathering line operators. In the
hazardous liquid space there are 550 pipeline operators and 25 liquid
natural gas facility operators.
Question 3. What steps is TSA taking to ensure the rest of our
pipeline systems are secure beyond just the top 100 owners and
operators?
Answer. Although TSA's risk-based focus has been on the most
critical pipeline owners and operators, TSA will continue to provide
relevant security information and guidance to all pipeline owner and
operators. TSA provides specific voluntary guidance to all pipeline
owner and operators as outlined in the TSA Pipeline Security Guidelines
(Guidelines). The Guidelines were updated in 2018 with a specific focus
on cybersecurity measures and again in 2021 (Change 1) regarding the
criteria to identify critical pipeline facilities. TSA expects to
update the Guidelines again in calendar year 2022 after consultation
with industry. This update will focus on additional cybersecurity
measures included in the Security Directives, as well as updated
guidance based on feedback received from the pipeline industry.
While section 1557 of the Implementing Recommendations of the 9/11
Commission Act of 2007 (Public Law 110-53; August 3, 2007) required TSA
to focus its assessments on the 100 most critical pipeline operators,
the Guidelines are applicable to all operational natural gas and
hazardous liquid transmission pipeline systems, natural gas
distribution pipeline systems, and liquefied natural gas facility
owner/operators. TSA conveys the importance of the Guidelines, provides
security alerts, and distributes sector-wide security information to
the larger stakeholder population with monthly pipeline industry calls
and information sharing via e-mail distributions to designated
cybersecurity coordinators and pipeline security managers.
Question 4. How does TSA plan on ensuring compliance with the
directive? What enforcement actions can TSA take against uncooperative
operators?
Answer. TSA will assign trained, credentialed Transportation
Security Inspectors to conduct inspections of regulated parties under
the Security Directive. TSA will use its inspection authority in
accordance with 49 USC 114(f) to verify that the covered pipeline
owner/operators are complying with the provisions of its security
directives. TSA will use its progressive enforcement process that can
result in civil penalties being levied against non-compliant parties.
TSA will ensure compliance with each applicable mitigation measure
through scheduled on-site visits and requests for documentation to
perform verification of compliance of mitigation measures. Both
verification processes are consistent with TSA's compliance inspection
methodology.
TSA will follow the regulatory framework for TSA's enforcement and
investigative procedures found within 49 CFR part 1503. TSA's
enforcement process includes the Action Plan Program, a program which
provides the opportunity for eligible parties and TSA to first discuss
and reach an agreement on corrective actions to address the root cause
of any security vulnerability or noncompliance with TSA's security
requirements which qualifies for this program, and then resolve that
vulnerability or noncompliance with administrative action instead of a
civil enforcement action.
If an alleged violation is discovered and it is not addressed
through on-the-spot counseling or resolved through an action plan, TSA
will send the owner/operator a Letter of Investigation notifying them
of the date, time, and a summary of the alleged violation. The owner/
operator will be given the opportunity to respond in 30 days and TSA
will consider the owner/operator's Letter of Response (LOR) to the
violation. After receiving the LOR or after the specified period of
time has elapsed, TSA will either close the matter with no action,
close the matter with an administrative action, or recommend a monetary
civil penalty.
______
Response to Written Questions Submitted by Hon. Kyrsten Sinema to
Hon. David P. Pekoske
Pipeline Security Initiative. In your testimony, you mentioned that
the Pipeline Cybersecurity Initiative (PCI), launched in 2018, aims to
assist pipeline owners and operators to prepare for and respond to
significant cyber events.
Question 1. Aside from the May and July 2021 pipeline security
directives issued by the Transportation Security Administration (TSA),
what other actions are needed to ensure that the Cybersecurity and
Infrastructure Security Agency (CISA) and TSA can make the PCI more
effective in helping pipeline companies identify cybersecurity risks
and develop strategies to prepare for, respond to, and mitigate
significant cyber events?
Answer. TSA has a close and collaborative partnership with the
Cybersecurity and Infrastructure Security Agency (CISA), U.S.
Department of Transportation (DOT), and the U.S. Department of Energy
(DOE), including technical support from the DOE National Laboratories.
The Pipeline Cybersecurity Initiative (PCI) brings together the
expertise of multiple interagency partners to conduct a series of
activities to assist pipeline owners and operators to enhance their
cybersecurity posture. Most recently PCI, TSA, and CISA's Cybersecurity
Division Insights Team conducted a review and analysis of the first
pipeline Security Directive and prepared a summary of findings. The
results of this analysis are being used to identify notable trends and
gaps in the cyber preparedness across the most critical pipeline owner/
operators and to produce a summary of corrective actions highlighting
appropriate recommendations and mitigations.
Throughout Fiscal Year (FY) 2021, TSA and CISA collaborated on
Validated Architecture Design Reviews (VADR), associated analysis, and
ultimately limited results-sharing with industry. Through PCI and other
similar Pipeline-focused initiatives, TSA will continue to collaborate
with interagency partners and pipeline owners/operators to prepare and
respond to significant cyber events.
Other actions are needed to ensure that CISA and TSA can make the
PCI more effective in helping pipeline companies identify cybersecurity
risks and develop strategies to prepare for, respond to, and mitigate
significant cyber events. These actions include:
1. Ensuring that the results from architecture reviews completed by
third-party assessors (i.e., those not done by CISA and Idaho
National Labs) as required by SD-2 are made available to TSA
and CISA and that the findings are captured in a way that can
be compared with existing VADR data that was collected in FY
2021.
2. Pipeline companies should take advantage of tools and resources
offered by CISA, such as cyber hygiene scanning, phishing
campaign assessments, and penetration testing so that CISA can
build a more holistic view of pipeline operators' overall
cybersecurity, as opposed to only control systems.
3. Findings from aggregated assessments of pipeline data should be
mapped back to industry standards (e.g., API 1164, IEC 62443)
to better communicate information in the language that the
pipeline industry and its associated stakeholders (e.g.,
manufacturers and integrators) utilize.
4. API 1164, once completed, could be included as an element of the
CyberSecurity Evaluation Tool (CSET) self-assessment. Efforts
are further coordinated through the Oil and Natural Gas
Subsector Coordinating Council, which is co-chaired by DOE and
DHS, with representatives from TSA and DOT, as well as other
Federal agencies as appropriate.
Challenges to Implementing Pipeline Security Directives. The Senate
Commerce, Science and Transportation Committee hearing spent some time
discussing the challenges of obtaining qualified cyber security experts
for TSA as well as the rest of the Federal government and private
industry.
Question 2. Aside from this talent gap, what other key challenges
does TSA face in implementing the new pipeline security directives and
in better positioning the agency to prepare for, respond to, and
mitigate future significant cyber events to its own systems?
Answer. A key challenge that TSA faces is ensuring that there is a
mutual understanding of the lexicon of Security Directive # 2
definitions and nomenclature. As Security Directives are new to the
pipeline mode, TSA must ensure owner/operators understand the tools
available to them to work with TSA towards compliance with the Security
Directive. These include alternative measures requests and requests for
additional time through the TSA Action Plan process. Additionally, TSA
is mindful of owner/operators impacted by acts of nature and is
allowing those affected by hurricanes and wild fires additional time to
complete required actions. Another key challenge is the continued
evolving nature of the cybersecurity threat. As pipeline transportation
systems build in automation and digitalization operational technology
systems that converge with Information Technology (IT) networks for
efficiencies and remote operations, the threat to their networks'
cybersecurity grows. Another challenge TSA faces is to ensure pipeline
owner/operators providing TSA with SD required information, take the
appropriate measures to protect that data while in transit (such as
encryption, HSIN, or TSA Secure Portal).
Regarding TSA's preparation, response, and mitigation measures for
any future significant cyber events against its own systems, we hold
each TSA system owner of a system that connects to a TSA system
responsible to the same cybersecurity standards and governance as
directed by the Federal Information Security Management Act of 2014,
Pub. L. 113-283, (Dec. 18, 2014), as amended, Office of Management and
Budget, National Institute of Standards and Technology, and the U.S.
Department of Homeland Security (DHS). Before granting approval for TSA
IT systems connectivity and operations, all system cybersecurity risks
must be identified and understood prior to acceptance of any risk or
non-compliance with mitigations is approved and authorized by the TSA
authorizing official.
Pipeline Cybersecurity and TSA Directives. TSA's May 2021 pipeline
security directive mandated that a pipeline owner/operator have a
cybersecurity coordinator, who (amongst other things) is required to
report significant cybersecurity incidents to CISA.
Question 3. Does this or the July 2021 security directive have any
provisions that would require a pipeline owner or operator to report
ransomware payments paid out in response to cyberattacks? If no, do you
feel like this should be required of pipeline companies and what
parameters would need to be provided?
Answer. TSA Security Directive Pipeline-2021-01 requires the
reporting of cybersecurity incidents to CISA. It does not require the
reporting of a ransomware payment paid out in response to a
cyberattack. While the reporting of ransomware payments is not
particularly relevant data to TSA's mission for the prevention of and
preparation for cyberattacks, it could be of value for law enforcement
and other investigative purposes. Information as to whether or not a
payment had been made by a victim of ransomware would normally be a
part of the investigative follow-up.
Question 4. If TSA receives notice of a cyberattack or a ransomware
payment from a pipeline owner or operator, what is your understanding
of the interagency process for coordinating efforts amongst key Federal
agencies? If TSA is notified rather than CISA, would that serve to meet
the new incident reporting requirements as prescribed in the May
security directive, and would TSA officers know how to start the
interagency coordination process amongst key stakeholders to quickly
gather information and respond to the attacks?
Answer. Overall, the U.S. Government works toward ensuring that a
notification to DHS, the Federal Bureau of Investigation, or a Sector
Risk Management Agency, is a notice to all, regardless of which agency
is notified first. If TSA receives a notice of a cyberattack or
ransomware payment from a pipeline owner or operator, TSA would notify
other relevant Federal agencies such as CISA, DOE, and their
coordination efforts amongst the Federal agencies would be guided by
Presidential Policy Directive 41 (PPD-41).
Pipeline Security Directive 2021-01 requires identified pipeline
owner/operators to contact CISA to report any cybersecurity-related
incident. If a pipeline owner/operator notified TSA rather than CISA,
TSA would immediately notify CISA. TSA's Transportation Security
Operations Center routinely coordinates incident response with CISA.
Additionally, DHS incident reporting guidelines would require the
reporting of certain incidents to the DHS National Operations Center,
which would assist with additional incident response coordination.
Question 5. With the May and July pipeline security directives, TSA
has moved into the role of a regulator of pipeline companies. How will
this impact TSA's work in building and maintaining robust public-
private partnerships with pipeline owners and operators to ensure the
safety and security of this critical infrastructure? What steps are you
taking to work to maintain trust and ongoing cooperation with your key
private sector stakeholders?
Answer. TSA recognizes that by issuing these Security Directives,
which may subject covered owner/operators to civil enforcement action,
some aspects of its engagement with pipeline owners and operators may
change. However, TSA has a strong history of collaborative engagement
with its stakeholders and will continue this relationship through
information sharing, identifying mutual security objectives, and
collaboration to reduce risks and enhance resiliency.
TSA is working directly with pipeline owners and operators to
achieve compliance with these Security Directives and enhance their
cybersecurity posture. TSA also continues to partner with industry on
its long-standing, well-established voluntary programs such as the CSR
and CFSR, and the most recent PCI-led VADR efforts. As important
pipeline security programs and initiatives are identified or developed,
or information sharing and threat briefing opportunities arise, TSA
will continue with its history of collaboration with the Surface
Transportation Security Advisory Council, the Pipeline Subsector
Coordinating Council, the Oil and Natural Gas Subsector Coordinating
Council, industry trade associations, and direct engagement with
pipeline stakeholders. TSA is committed to maintaining its successful
public-private partnership with pipeline owners and operators to ensure
that the necessary security measures are in place while maintaining
operational safety and efficiency.
Question 6. It is noted that the May and July pipeline security
directives, these apply to the major owners and operators of TSA-
designated critical pipelines. Are there any plans to have similar
requirements or guidance issued for the smaller pipeline owners?
Answer. TSA uses a risk-based approach to identify critical
pipeline owner/operators that are subject to Security Directives. The
method used considers multiple variables to assess threat,
vulnerability, and consequence. Data sources include, but are not
limited to, publicly available throughput volumes, and information from
the U.S. Departments of Defense, Transportation, and Energy. Volumetric
throughput is given the most weight. Although there are no current
plans to subject non-critical pipeline owner/operators to TSA Pipeline
Security Directives, TSA may reconsider this position under the
appropriate circumstances. TSA provides specific voluntary guidance to
all pipeline owner/operators in the TSA Pipeline Security Guidelines
(Guidelines). The Guidelines were updated in 2018 with a specific focus
on cybersecurity measures and again in 2021 (Change 1) regarding the
criteria to identify critical pipeline facilities. TSA expects to
update the Guidelines again in calendar year 2022 in consultation with
key industry stakeholders. This update will focus on additional
cybersecurity measures included in the Security Directives as well as
updated guidance from the pipeline industry e.g., the recently updated
cybersecurity guidelines from the American Petroleum Institute (API
1164).
______
Response to Written Questions Submitted by Hon. Ben Ray Lujan to
Hon. David P. Pekoske
DOE Role in Pipeline Security. Securing our oil and natural gas
pipeline systems is a hard problem, one that needs research, just like
other critical infrastructure. Several national laboratories support
the DOE's cyber office and DHS' Cybersecurity and Infrastructure
Security Agency (CISA) both in understanding cyber vulnerabilities for
energy technologies and in modeling the resilience and reliability of
these systems.
Question 1. How is TSA working with the Department of Energy and
its National Laboratories to access their cybersecurity subject matter
expertise?
Answer. In TSA's pipeline coordination role as the co-Sector Risk
Management Agency for the Transportation Systems Sector, TSA continues
to take a whole-of-government approach to strengthening the physical
and cybersecurity of pipelines with multiple government agencies. We
work in collaboration with CISA and the DOE's Office of Cybersecurity,
Energy Security, and Emergency Response, as Sector Risk Management
Agency to the energy sector, DOE's Idaho National Laboratory (INL), and
the DOT's Pipeline and Hazardous Materials Safety Administration.
Interagency agreements have allowed for TSA to utilize INL expertise to
provide extensive cybersecurity training for our cyber Pipeline
Security Assessment Team (PSAT). The cyber PSAT staff have received a
wide variety of introductory and continuing cybersecurity education
opportunities including at the INL training facility in Idaho Falls,
ID.
Question 2. Does TSA currently face barriers that prevent it from
more coordination with DOE and the National Laboratories to improve
resiliency of pipeline cybersecurity?
Answer. TSA relies on the availability of Congressional funding to
integrate advanced cybersecurity tools and other technical capabilities
offered through INL, which in turn supports newer and more intuitive
ways to improve pipeline cybersecurity and resiliency. Low or a
decrease in funding may hinder or prevent more coordination with INL in
the ability to support contractual interagency agreements.
______
Response to Written Questions Submitted by Hon. Marsha Blackburn to
Hon. David P. Pekoske
Background: During the hearing, you talked about GAO's
recommendations to TSA. Specifically, the recommendation for TSA to
seek more comprehensive data information from sources beyond just
pipeline operators to contribute to better assessing the cyber threat
environment.
Question 1. Why would TSA move forward with directives to the
pipeline industry without full and complete data?
Answer. The decision to issue Security Directives 2021-01 and 2021-
02 was based on a determination that immediate action was necessary to
protect transportation security. This determination reflected
information regarding the current risk as well as threat information
from classified, unclassified, and open source material. It is
important to note that the Government Accountability Office's (GAO)
recommendation related to seeking more comprehensive data from sources
beyond pipeline operators that could inform the Transportation Security
Administration (TSA) Pipeline Risk Ranking Tool, resulting in a more
holistic view of risks to pipeline systems; it was not focused on
assessing cybersecurity threats.
Question 2. What is your plan for collecting the sources of outside
data GAO has identified?
Answer. TSA continues to work on the GAO's recommendation. The
Agency is collecting information from multiple sources, including the
U.S. Department of Transportation's Pipeline and Hazardous Materials
Safety Administration (PHMSA), the U.S. Department of Homeland
Security's (DHS) Cybersecurity and Infrastructure Security Agency
(CISA), the Department of Energy, and the Federal Energy Regulatory
Commission, as well as the industry-led Pipeline Subsector Coordinating
Council and Oil and Natural Gas Subsector Coordinating Council. These
efforts are intended to ensure that TSA is aware of and considering all
risks to the pipeline sector. In particular, TSA discusses risk
elements with both Federal and industry partners in conjunction with
the CISA Pipeline Cybersecurity Initiative, which meets regularly. TSA
directly engages with approximately 200 industry security personnel on
current security risks and initiatives during regular TSA-led
stakeholder meetings.
______
Response to Written Questions Submitted by Hon. Maria Cantwell to
Hon. Polly Trottenberg
PHMSA Control Room Management Reviews and Audits. The Pipeline and
Hazardous Materials Safety Administration (PHMSA) conducts routine
audits and reviews of pipeline operators' control room management and
other elements of pipeline operations.
Question 1. As a part of these reviews and audits, does PHMSA
consider cybersecurity hygiene? If so, what elements of cyber security
does PHMSA evaluate as part of these reviews and audits?
Answer. As part of a five-year program started in 2019 to promote
good cyber hygiene with pipeline operators, PHMSA offers cybersecurity
risk discussions to pipeline operators when it conducts regulatory
inspections of Control Room Management (CRM) programs. PHMSA's intent
is to raise awareness throughout the entire pipeline industry of cyber
vulnerabilities and assure companies know about the Transportation
Security Administration's (TSA) cybersecurity measures, as detailed in
TSA's Pipeline Security Guidelines (current version April 2021).
Further, because cybersecurity issues can affect pipeline's physical
operations, PHMSA invites pipeline operators to discuss cybersecurity
issues. The cybersecurity risk discussion is not part of PHMSA's CRM
compliance inspection, nor does it function as an inspection. Its
purpose is to raise awareness of the importance of thorough
cybersecurity practices--and to better prepare both regulators and
operators for cybersecurity incidents.
PHMSA advises pipeline operators that the TSA is the regulatory
authority for security issues. PHMSA documents if an operator agrees to
engage in a cybersecurity risk discussion but does not record the
details from the cybersecurity risk discussions. If the discussions
result in the identification of significant cybersecurity risk or
vulnerability, PHMSA shares those findings with TSA and the
Cybersecurity and Infrastructure Security Agency (CISA). As part of the
five-year program, PHMSA has offered to have discussions with 113
pipeline operators. Approximately 50 percent have declined. PHMSA will
offer to conduct cybersecurity risk discussions for the remaining 153
operators within the next three years. Since the May 2021 cybersecurity
incident involving Colonial Pipeline, 100 percent of operators have
accepted PHMSA's invitation to participate in a cybersecurity related
discussion during CRM inspections.
Question 2. Does PHMSA alert the Transportation Security
Administration (TSA) about if they identify any cybersecurity concerns
or vulnerabilities identified as a part of PHMSA's oversight of
pipeline operators?
Answer. Yes, PHMSA provides any significant cybersecurity risks or
vulnerabilities identified during a cybersecurity risk discussion to
TSA via secure file transfer or by password protecting a word document
and marking it Sensitive Security Information (SSI).
NIST Cybersecurity Standards. The National Institute for Standards
and Technology (NIST) worked with the private sector to create a
Cybersecurity Framework with voluntary standards and practices to
promote the protection of critical infrastructure. These standards
represent best practices for responsible cybersecurity management of
critical infrastructure to understand and mitigate cybersecurity risks.
In 2018, GAO reviewed efforts by Federal agencies to promote awareness
and adoption of the NIST Cybersecurity Framework among owners and
operators of critical infrastructure, including transportation
infrastructure.
GAO found that the Department of Transportation and the Department
of Homeland Security had worked to promote awareness and use of the
framework applied to critical infrastructure, but that the agencies did
not have information to know the extent of adoption within the
transportation sector. GAO recommended that both agencies take steps to
determine the level and type of framework adoption across critical
infrastructure in the transportation sector.
Question 3. What has DOT done to implement this recommendation to
understand to degree to which transportation entities have implemented
the NIST Cybersecurity Framework?
Answer. DOT and the Department of Homeland Security (DHS) are Co-
Sector Risk Management Agencies (Co-SRMAs) for the Transportation
Systems critical infrastructure sector (Sector), meaning they share
responsibility for using specialized expertise to support Sector risk
management, establish and carry out programs to assist critical
infrastructure owners and operators, and facilitate information sharing
among other duties. In addition to efforts DOT Operating
Administrations took to promote the adoption of NIST Cybersecurity
Framework with critical infrastructure stakeholders, the Co-SRMAs
incorporated discussion and promotion of the framework throughout
various Sector-related stakeholder engagements.
Furthermore, the Co-SRMAs developed a draft survey to determine the
level and type of framework adoption within the Sector, and the Co-
SRMAs shared the draft survey with Sector Coordinating Council (SCC)
leads and Sector stakeholders in May 2020 to seek voluntary comments
that would inform how the Co-SRMAs finalized the survey.
In March 2021, the Co-SRMAs shared the final survey with SCC leads
and Sector stakeholders so they had opportunity to complete the survey
voluntarily, and the Co-SRMAs requested their voluntary assistance in
distributing the survey as broadly as possible within the Sector. The
Co-SRMAs are working on a report of the survey findings that may
include recommendations the Co-SRMAs can consider to increase awareness
and adoption of the framework.
Question 4. Should the practices outlined in the NIST Cyber
Security Framework be made mandatory for transportation industries?
Answer. Cybersecurity by nature is a dynamic and evolving field. As
noted in the NIST Framework, the Framework is not a one-size-fits-all
approach to managing cybersecurity risk for critical infrastructure.
Organizations will continue to have unique risks--different threats,
different vulnerabilities, different risk tolerances. Transportation
critical infrastructure entities are encouraged to use the Framework;
however, mandating frameworks may cause unintended consequences. While
there is no coordinated requirement for cybersecurity across all
critical infrastructure, including the transportation industries,
cybersecurity standards and frameworks, such as the NIST Cyber Security
Framework, should be utilized to establish baseline practices that
owners and operators can follow to protect national and economic
security, as well as public health and safety.
Manual Operation of Pipelines. There was enormous pressure to get
the Colonial Pipeline back up and running after the ransomware attack.
To expedite this process Colonial decided to manually operate the
pipeline. This required people to physically open and close valves at a
number of different locations to get different products from one place
to the next. It is my understanding that this process is
extraordinarily rare in modern times and requires a number of highly
trained operators to work around the clock.
Question 5. What processes does PHMSA currently have in place to
ensure the manual operation of a pipeline in response to an emergency
is safe?
Answer. If a pipeline company chooses to operate in manual mode,
appropriate procedures must be in place by operators or be established
prior to implementation of manual operations. Additionally, personnel
must be qualified to perform the manual operation functions. Per 49
C.F.R. Sec. 192.605 and Sec. 192.615, pipeline operators must prepare a
manual of written procedures for normal operations, maintenance
operations, and emergency response. With the widespread deployment of
electronically managed pipeline systems, there has been a sharp decline
in the utilization of manual operations. In response to the recent
Colonial Pipeline cybersecurity event, PHMSA is reviewing pipeline
companies' preparedness to respond to, and safely recover from, a
cyber-attack, including the potential need for manual operation of all
or portions of its facilities.
______
Response to Written Questions Submitted by Hon. Tammy Duckworth to
Hon. Polly Trottenberg
GPS Resiliency and Backup. The U.S. Global Positioning System (GPS)
is critically important to our nation, providing position, navigation
and timing (PNT) services that underlie our economic and national
security. Sixteen critical infrastructure industries rely on GPS for
PNT, including telecommunications, electrical grid, public safety,
aviation and auto industries. A study by the National Institute of
Standards and Technology (NIST) found that GPS has an overall economic
impact of $700-$800 billion and is doubling every two to three years.
Unfortunately, GPS systems elsewhere in the world are increasingly
threatened by disruption, jamming, and attacks by malicious actors. As
co-chair of the Senate GPS Caucus, it is apparent to me that continuing
GPS modernization and resiliency efforts that ensure our system
continues to be the world's PNT gold standard is vitally important.
Dating back to 2004, Congress and the Executive Branch expressed
interest for establishing or improving GPS resiliency. Defense
authorization legislation enacted in 2017 and 2018 tasked USDOT, DHS
and DOD with developing a GPS backup strategy and an Executive Order
was issued on PNT resilience recommending a combination of systems to
increase GPS resiliency. In 2018, the National Timing Resilience and
Security Act (NTRSA) was enacted to support the deployment of a land-
based GPS backup.
Executive Order 13905 in February 2020 followed by a January 2021
report by USDOT, in conjunction with DOD and DHS, affirmed the Federal
perspective that no one technology can address all potential use cases
and a nationwide backup requires a combination of technologies.
Question 1. What steps is USDOT taking to implement the
recommendations of the January 2021 report and to procure GPS backup
technologies based on the report's recommendations? Is USDOT advancing
demonstration efforts highlighted in its report to ensure the U.S. has
available a full backup system for PNT services across our critical
infrastructure?
Answer. DOT's Office of the Assistant Secretary for Research and
Technology (OST-R), through work authorized and funded under the FY
2018 National Defense Authorization Act (NDAA), has demonstrated
suitable and mature PNT technologies that can complement GPS and could
provide a backup to GPS/Global Navigation Satellite System (GNSS)
service in case of a major disruption. Many of these technologies are
already commercially available for owners and operators of critical
infrastructure to utilize (particularly for timing). In many of these
most critical infrastructure sectors that rely on timing, it is the
financial cost associated with these alternate systems that hampers
adoption. GPS and the foreign GNSS systems are provided free of direct
user fees. Despite the known vulnerabilities with GPS/GNSS, most users
are unwilling to adopt other available PNT systems because they are
only available for a fee. Barring economic justifications, regulatory
requirements or incentives, adoption of alternate PNT systems will
remain limited.
However, recognizing that the transportation sector has some of the
most stringent performance requirements for both positioning and
navigation, as well as timing, in terms of accuracy, integrity,
availability, and reliability, DOT is developing system requirements
that focus on safety and resilience. These system requirements will
allow determination of which PNT performance requirements can be
currently met and which requirements may require further innovation.
Based on recommendations from the DOT Complementary PNT
Demonstration Report to Congress submitted in January 2021 (https://
www.transportation.gov/briefing-room/us-dot-releases-complementary-
positioning-navigation-and-timing-pnt-and-gps-backup), there are three
components in the President's FY 2022 budget request for DOT to pursue:
1. Development of safety-critical PNT standards for transportation
services.
2. Development of a PNT vulnerability and performance testing
framework on demonstrated and suitable complementary
technologies.
3. Development of PNT performance monitoring capabilities to ensure
PNT services provide operational resilience and achieve safety-
critical standards.
These efforts will further develop PNT modeling, simulation, and
testing tools, as well as standards and performance monitoring tools.
These capabilities are needed to evaluate integration of diverse
positioning, navigation, and/or timing technologies and will facilitate
successful transition and adoption into end-user applications.
______
Response to Written Questions Submitted by Hon. Kyrsten Sinema to
Hon. Polly Trottenberg
Cybersecurity Workforce at the Department of Transportation. The
Senate Commerce, Science and Transportation Committee hearing spent
some time discussing the challenges of obtaining and retaining
qualified cyber security experts within the Federal government. I
understand that the Department of Transportation (DOT) is currently
working on a Government Accountability Office (GAO) recommendation to
identify all cybersecurity occupations across the agency to better
assess whether any changes are needed to DOT's workforce planning
efforts (GAO-21-197).
Question 1. Can provide any general findings as to what degree gaps
in this skill field are hindering the agency's ability to effectively
oversee all aspects of the U.S. transportation system?
Answer. Ensuring that the Department has a workforce with the
skills and competencies to meet the challenges of the future is a
priority for DOT. The Department's Highly Automated Systems Safety
Center of Excellence (HASS COE) is currently working with each DOT
Operating Administration to determine their current automation
workforce status, needs, and plans. In partnership with the DOT Office
of Human Resources, the assessments will determine competencies and
assess skill gaps in key occupational groups that are involved in
overseeing the safety of automated technologies. We will use the
results of the assessments, along with our workforce planning efforts,
to work with all of our Operating Administrations to address the
recommendations in the GAO report.
Further, the FAA is part of a jointly led Aviation Cyber Initiative
that partners with the Department of Homeland Security and Department
of Defense. The focus is on addressing cybersecurity risk to the
Nation's Aviation Ecosystem to support the National Strategy for
Aviation Security (NSAS). FAA manages cybersecurity threats to the
national airspace system through a cybersecurity steering committee
that manages risks and training through annual updates to the FAA
Cybersecurity Strategy. These efforts will help DOT better understand
the impacts on the overall U.S. transportation system.
Question 2. Aside from the talent gap, what other key challenges on
the cybersecurity front does DOT face in overseeing and enforcing
pipeline control room regulations, integrity management plan
requirements, and emergency response plan regulations?
Answer. A key challenge is the need to increase awareness
throughout the entire industry of the risk of cyber-attacks and each
company's vulnerability to those attacks. Many companies, especially
smaller or lower profile facilities, may not believe they are at risk
or consider minimal protections as adequate. Further, without
specialized training, it is difficult for Federal and state inspectors
to identify cyber--and therefore potential safety and/or environmental
risks--on pipeline facilities. Cyber related attacks can directly
result in pipeline failures, releasing hazardous materials and
potentially harming people and the environment. PHMSA has requested
increased funding in its FY 2023 budget to provide cyber awareness
training to more Federal and state inspectors. Increasing awareness and
training of cyber vulnerabilities and what constitutes good cyber
hygiene among industry and Federal/state agencies is critical to
improving the protection of the Nation's infrastructure.
DOT preparedness to Respond to Cyber Attacks. Recent cyberattacks
affecting our Nation's gasoline supply serve as a reminder that
virtually every industry is vulnerable to cyber events.
Question 3. In addition to Pipeline Systems, how would DOT grade
its preparedness to respond to and mitigate significant cyber events in
other key Transportation Systems subsectors--such as aviation, highway
and motor carrier, maritime, mass transit and passenger rail, freight
rail, and postal and shipping? Are there any lessons learned from
recent events over improving the cyber response and resilience to
pipeline systems that should be implemented in the other subsectors?
Answer. Since DOT and DHS are Co-SRMAs for the Transportation
Systems critical infrastructure sector, DOT's preparedness to respond
to and mitigate significant cyber events across the Sector--regardless
of which subsector listed is impacted--centers largely on the Co-SRMAs'
efforts to fulfill the SRMA role, in coordination with the Cyber
Unified Coordination Group (UCG), as prescribed in Presidential Policy
Directive (PPD) 41, United States Cyber Incident Coordination, released
in 2016. Per PPD-41, the Co-SRMAs developed enhanced coordination
procedures to prepare for situations related to critical infrastructure
in which the demands of a significant cyber incident exceed one
department or agency's capacity. DOT and DHS tested these procedures
during the biennial Cyber Storm exercise in 2018. For its part, DOT
will update its enhanced coordination procedures in 2022, in
coordination with DHS.
Regarding lessons learned, as personnel can change from one year to
the next, the Department realized the need to solidify and emphasize
DOT's internal understanding of the unique response or mitigation
elements associated with a cyber incident response. These elements can
differ significantly depending on the circumstances from more
``traditional'' response measures associated with physical incidents,
such as hurricanes. In turn, following the Cyber Storm exercise, and as
part of DOT's internal efforts to streamline its incident response
plans, DOT developed a Cyber Annex to DOT's 2020 ``All Threats, All
Hazards Response and Recovery Deliberate Plan.'' The 2020 Annex
includes some interagency actions and updates to PPD-41 requirements,
which apply to pipeline systems as well as other subsectors.
Question 4. If DOT receives notice of a cyberattack or a ransomware
payment from a pipeline owner or operator, what is your understanding
of the interagency process for coordinating efforts amongst key Federal
agencies? If DOT is notified rather than CISA, would DOT experts know
how to start the interagency coordination process amongst key
stakeholders to quickly gather information and respond to the attacks?
Answer. If DOT directly received such a notice, the immediate step
is to ensure that the owner or operator report such incidents to the
DHS Cybersecurity and Infrastructure Security Agency (CISA). DOT, when
made aware, also notifies CISA. In addition, PPD-41 outlines the
standing process for interagency coordination among key Federal
agencies related to critical infrastructure.
Furthermore, as Co-SRMAs for the transportation systems sector, DOT
and DHS (through the Transportation Security Administration (TSA) and
the United States Coast Guard (USCG)) have a strong, long-standing
relationship that exemplifies how the Federal Government builds trusted
partnerships and advances a national unity of effort to strengthen and
maintain a secure, functioning, and resilient transportation sector.
The Co-SMRAs play a critical role in sharing of threat and intelligence
information, as well as other information and products, which directly
supports the implementation of PPD-21, PPD-41, and Executive Orders on
cybersecurity.
TSA has the authority to issue Security Directives (SDs) and has
used this authority to issue several SDs. In turn, the Transportation
Security Oversight Board (TSOB)\1\ authorizes the effective timeframes
of the SDs. TSA initially released SD Pipeline-2021-01 in May 2021--
amended in December 2021 and effective through May 28, 2022--which
requires pipeline owners and operators to report cybersecurity
incidents to CISA when they involve systems that the owner/operator has
responsibility to operate and maintain.
---------------------------------------------------------------------------
\1\ 49 U.S.C. Sec. 115(c)(1); 49 U.S.C. Sec. 114(l)(2)(B).
---------------------------------------------------------------------------
TSA issued a complementary SD--mandating that critical owners and
operators of gas and liquid pipelines implement an array of
cybersecurity measures to prevent disruption and degradation to their
infrastructure--in July 2021 (amended in December 2021) that is
effective through July 26, 2022. This SD generally requires owners and
operators to: 1) implement critically important mitigation measures to
reduce the risk of compromise from a cyberattack; 2) develop a
Cybersecurity Contingency/Response Plan to reduce the risk of
operational disruption or significant business or functional
degradation of necessary capacity should the Information and/or
Operational Technology systems of a gas or liquid pipeline be affected
by a cybersecurity incident; and 3) evaluate and validate the
cybersecurity of their ICS networks through an annual validated
architecture design review.
TSA also published two SDs in December 2021, SD 1580-2021-01 and SD
1582-2021-02, for higher risk railroads and rail transit owner/
operators that require measures to improve cybersecurity preparedness
including appointment of cybersecurity coordinators, reporting of
cybersecurity incidents to CISA, conducting a cybersecurity
vulnerability assessment, and development of cybersecurity incident
response plans. TSA also distributed an Information Circular, IC-2021-
01, recommending the same measures for lower risk railroads, public
transportation, and over-the-road buses, followed by a similar
Information Circular for pipeline entities beyond those addressed in
the first two pipeline SDs.
DOT supported the review and development of these SDs and supported
coordination for stakeholder engagements with industry to provide
information and solicit feedback and questions on the SDs. Further, DOT
serves as a principal member of the TSOB, led by DHS and established
under the Aviation and Transportation Security Act, to provide guidance
regarding transportation security-related matters. As a TSOB member,
DOT is responsible for reviewing and ratifying or disapproving
emergency regulations or security directives issued by TSA, including
the recently issued pipeline security directives. In light of DOT's Co-
SRMA role alongside DHS and TSOB membership, DOT regularly coordinates
with DHS/TSA counterparts and is well-positioned to prompt and
establish necessary interagency coordination processes amongst key
stakeholders to facilitate quick information sharing and response.
DOT is also aware that TSA has significantly increased its
cybersecurity expertise through hiring and focusing resources to
support cybersecurity enhancements for all modes of transportation.
TSA under its Surface Operations program component has established
its own Cybersecurity Branch which has been staffed with a team of 11
cybersecurity experts that possess expert level technical skills and
unique specialized cyber experience to support surface cross-modal
cybersecurity efforts. This newly established unit will allow TSA to
carry-out a number of both timely and critical cybersecurity related
functions to enhance the security and resilience of the surface
transportation system sector, as well as advance other TSA cyber-
related mission requirements.
TSA's cybersecurity subject matter experts have specialized
knowledge and experience related to Operational Technology/Industrial
Control Systems (OT/ICS) networks, vulnerability analysis, cyber
incident analysis and mitigation, assessments, and defense. This
aforementioned expertise has been obtained through their experience
with cybersecurity industry leaders such as DHS, CISA, U.S. Department
of Defense (DoD), and U.S. Department of Energy (DoE), Idaho National
Laboratory (INL). Additionally, these candidates bring a variety of
industry-recognized cybersecurity certifications to TSA Surface
Operations from the SysAdmin, Audit, Network, and Security (SANS)
Institute, various Global Information Assurance Certifications (GIACs),
and other relevant organizations.
______
Response to Written Questions Submitted by Hon. Ron Johnson to
Hon. Polly Trottenberg
Background: According to a 2018 Department of Transportation (DOT)
report, pipelines are a safer mode of transportation for shipping oil
than truck and rail. However, due to President Biden's revocation of
the Presidential Permit for the Keystone XL pipeline, Canadian oil will
likely enter the U.S. market by rail and trucks.
Question 1. Could you please state whether transporting oil by
pipeline continues to be a safer mode of transportation?
Answer. On January 20, 2021, President Biden revoked the March 29,
2019 Presidential permit for the Keystone XL pipeline, finding that it
does not serve the U.S. national interest and that leaving the Keystone
XL pipeline permit in place would not be consistent with the
Administration's economic and climate imperatives.
Pursuant to a directive from Congress, in 2018, the Pipeline
Hazardous Materials Safety Administration (PHMSA) produced a Report on
Shipping Crude Oil by Truck, Rail, and Pipeline. The report includes
safety data by year and by mode, including total incidents, spill
rates, serious injuries, and fatalities and is available here: https://
www.phmsa.dot.gov/sites/phmsa.dot.gov/files/docs/news/70826/report-
congress-shipping-crude-oil-truck-rail-and-pipeline-32019.pdf.
According to the report, shipping oil by pipeline is safer than
other modes of transportation based on comparisons of certain safety
indicators, including percent spilled and incident rate. The report
does indicate that other modes of transportation would be considered
safer than pipelines if human consequences are the main indicator.
However, the relative comparison of serious injuries and fatalities
between modes demonstrates that there is relatively no difference
between modes because serious injuries and fatalities are extremely
rare.
Follow-up. Could you please provide DOT's estimates for how
revoking the permit may affect the traffic fatalities from increased
road congestion and accidents?
Answer. DOT does not have estimates of this nature.
Question 2. Did DOT conduct an economic impact analysis on the
impact of revoking the Keystone XL pipeline permit? If yes, could you
please provide DOT's estimates for how revoking the permit may affect
truck and rail transportation costs?
Answer. No.
Follow-up. Could you please explain how this decision may affect
timeliness and delays for current freight traffic schedules?
Additionally could you please provide DOT's estimates for how revoking
the permit may affect freight and road traffic congestion?
Answer. N/A.
Background: President Obama's State Department issued environmental
reviews that found no major environmental objections to the pipeline on
five separate occasions and that alternative methods to get oil from
Canada to Gulf state refineries are worse for climate change.
Question 1. Do you agree with President Obama's State Department's
assessment? If not, please explain.
Answer. Congress has granted PHMSA with authority to review
pipeline design, and to monitor the construction, operations, and
maintenance of pipelines. Congress has granted other agencies and
departments the role of reviewing siting decisions, energy market
dynamics, and, environmental impacts. In light of President Biden's
revocation of the March 29, 2019 Presidential permit for the Keystone
XL pipeline, DOT does not have plans to review previous Department of
State assessments.
Question 2. Could you please state whether transporting oil by
pipeline is a more environmentally friendly mode of transportation than
by rail or truck?
Answer. Transporting oil by pipeline allows for greater volumes to
be moved longer distances more quickly and efficiently than by rail or
truck; however, pipeline spills tend to be far greater in size than
rail car or truck spills. Comparability is further hampered by
differences in incident-reporting criteria between the modes.
Question 3. Could you please provide DOT's estimates for any
increase for oil leaks or spills from using potentially more risky
modes of transportation like truck and rail?
Answer. DOT focuses on safety in all modes of transportation.
Because each mode has its own unique incident causes related to oil
spills--from operator error to mechanical defect to third-party damage,
it is difficult to make comparative predictive studies of potential
spills. Using the compiled information in the aforementioned 2018
Report on Shipping Crude Oil by Truck, Rail, and Pipeline, which is the
most readily available data, the spill percentage, i.e., volume spilled
per volume transported for 2014, 2015 and 2016\1\ were:
Spill Percentage (volume spilled per volume transported)
----------------------------------------------------------------------------------------------------------------
Pipeline Rail Truck
----------------------------------------------------------------------------------------------------------------
2016 0.0011% 0.0008% 0.0003%
----------------------------------------------------------------------------------------------------------------
2015 0.0006% 0.0116% 0.0009%
----------------------------------------------------------------------------------------------------------------
2014 0.0005% 0.0009% 0.0016%
----------------------------------------------------------------------------------------------------------------
As seen above, the percentages varied widely by year as is common
in low frequency, high consequence industries.
Question 4. Did DOT conduct any analyses examining the
environmental impact from revoking the permit for the Keystone XL
pipeline?
Answer. No. The revocation was not a DOT action necessitating a DOT
environmental review.
Follow-up: If yes, could you please provide details of the analyses
such as the estimated change in greenhouse gas emissions and
temperature due to replacing pipeline use with rail and truck use?
Answer. N/A.
______
Response to Written Questions Submitted by Hon. Marsha Blackburn to
Leslie V. Gordon
Background: During the hearing, you talked about GAO's
recommendations to TSA. Specifically, the recommendation for TSA to
seek more comprehensive data information from sources beyond just
pipeline operators to contribute to better assessing the cyber threat
environment.
Question. What specific types of data does GAO believe would be
helpful for TSA to collect?
Answer. In our December 2018 report, we identified several factors
that likely limit the usefulness of TSA's risk assessment in
effectively prioritizing TSA security reviews of pipeline systems.\1\
Specific to cybersecurity information, we found that the risk
assessment did not include a measure of cybersecurity vulnerabilities.
According to Pipeline Security Branch officials, absent data specific
to pipelines on their cyber vulnerabilities, they were unable to
include a pipeline's vulnerability to cyberattack in their risk
assessment. In our report, we stated that developing a feedback
mechanism between TSA and pipeline operators based on their
implementation of TSA's Pipeline Security Guidelines--including those
on cybersecurity--could be an important input into TSA's risk
assessment's vulnerability calculation. This information would also
inform the amount of risk pipeline companies are reducing by
implementing the guidelines and could be used to inform overall risk
reduction. In addition, we found that TSA's risk assessment did not
include threats to cybersecurity, such as data on prior attacks.
According to National Institute of Standards and Technology (NIST) risk
management guidance, although risk models differ in the degree of
detail and complexity with which threats are factored, threats are a
foundational element for all cybersecurity risk models.\2\
---------------------------------------------------------------------------
\1\ GAO, Critical Infrastructure Protection: Actions Needed to
Address Significant Weaknesses in TSA's Pipeline Security Program
Management, GAO-19-48 (Washington, D.C.: Dec. 18, 2018).
\2\ NIST, Guide for Conducting Risk Assessments, Special
Publication 800-30 Revision 1 (Gaithersburg, M.D.: Sept. 2012).
---------------------------------------------------------------------------
Similarly, in February 2018 and February 2020, we found that the
Department of Transportation (DOT) and DHS had not developed methods
for determining the level and type of adoption of the NIST Framework
for Improving Critical Infrastructure Cybersecurity by entities across
the transportation sector--including the pipeline subsector.\3\ We
concluded that, until DOT and DHS have a more comprehensive
understanding of the use of the cybersecurity framework by entities
within the Transportation sector, they will be limited in their ability
to understand the success of protection efforts or to determine where
to focus limited resources for cyber risk mitigation. We made two
recommendations that DOT, in coordination with DHS, should take to
address this weaknesses. DOT agreed with the recommendations but has
not yet addressed them.
---------------------------------------------------------------------------
\3\ GAO, Critical Infrastructure Protection: Additional Actions
Needed to Identify Framework Adoption and Resulting Improvements, GAO-
20-299 (Washington, D.C.: Feb 25, 2020); Critical Infrastructure
Protection: Additional Actions Are Essential for Assessing
Cybersecurity Framework Adoption, GAO-18-211 (Washington, D.C.: Feb 15,
2018).
Follow-up. Does the absence of any of these data sources suggest
that the TSA was hasty in adopting the two security directives?
Answer. The absence of cybersecurity vulnerability data sources
does not necessarily suggest that TSA was hasty in adopting its May and
July 2021 security directives. The security directives require pipeline
operators to take certain measures to address cybersecurity
vulnerabilities, whereas the cyber risk information referred to above
is to be used by TSA to prioritize its resources when conducting TSA
security reviews of pipeline systems. However, we have not reviewed
TSA's decision to require that certain pipeline owners and operators
implement cybersecurity practices as part of the second security
directive. When making such requirements, it is important that agencies
fully consider the cybersecurity risks--including the likelihood of
cyberattacks and their potential impact--what cybersecurity practices
are needed to address those risks, and the costs that implementing
these practices will impose on the owners and operators.
[all]