Colonial Pipeline, which suspended operations Friday after a “ransomware” attack on the company’s computer systems, said Thursday that its pipeline connecting Texas to New Jersey has been fully reactivated and fuel shipments have resumed. But significant shortages continued across numerous states, and drivers again complained of being stuck in long lines and encountering empty gas stations.
President Biden and top aides sought to ease growing political fallout over the fuel shortages, as Republicans accused the White House of failing to defend the importance of American-made energy and responding inadequately to the hack.
Transportation Secretary Pete Buttigieg called the ransomware attack a “wake-up call” that raises questions about whether the nation’s laws and political system are prepared for what he called “the cyber era.” And Biden touted a new Justice Department task force to go after DarkSide, a hacker group that infiltrated Colonial Pipeline’s servers and said it would not relinquish control without a ransom.
“This is a whole-of-government response to get more fuel more quickly to where it’s needed and to limit the pain being felt by American customers,” Biden said Thursday after summarizing the steps he had taken, such as enabling truck drivers to work more hours and deliver greater quantities of gas as the pipeline raced to get back in service.
Colonial Pipeline restarted operations Wednesday night and had fuel flowing through its pipes again by late afternoon Thursday. But the Alpharetta, Ga.-based company warned it could be a few days before kinks in the supply chain are worked out. Starved gas stations stretching across the Southeast from Texas to New Jersey will have to wait on a “region-by-region return to normalcy beginning this weekend and continuing into next week,” Biden said.
“We can now report that we have restarted our entire pipeline system and that product delivery has commenced to all markets we serve,” Colonial Pipeline spokesman Eric Abercrombie said late Thursday afternoon.
He cautioned, however, that it will take several days for the fuel supply chain to return to normal and some of the areas it serves will continue to experience service outages in the meantime.
“Colonial will move as much gasoline, diesel and jet fuel as is safely possible and will continue to do so until markets return to normal,” Abercrombie said.
Even as the crisis started to abate, the ease with which a critical artery of America’s transportation system was felled by a common online attack prompted a soul-searching among national leaders and cybersecurity experts.
The pipeline shutdown was caused by a ransomware attack on the company’s information technology systems; a type of hack in which faceless attackers seize important data, shut out the intended users and demand a ransom. It’s a common and well-known heist that online criminals have employed for decades.
It was unclear how Colonial was able to regain control of its system so that it could restart its pipeline. On Wednesday, The Washington Post reported that Colonial didn’t have a plan to pay a ransom to DarkSide to decrypt data files, but on Thursday several other news outlets reported that Colonial did pay to unlock its data.
The incident’s economic ripple effects were stark and sweeping, as the pipeline crisis was compounded by a man-made shortage driven by panic buying. Despite warnings from government officials and experts, drivers drained more than 17,000 stations throughout the Southeast, including many that would not otherwise have been affected by the pipeline hack.
Along Coleman Boulevard in Mount Pleasant, S.C., only two of the six filling stations have gas. Cars are not lining up as they were earlier in the week, but there is a steady stream at the few working pumps along this busy corridor.
U.S. Postal Service mail carrier Chris Corbin, 48, pulled his mail truck up to the Exxon near his residential route in Mount Pleasant’s historic Old Village. “I’ve only got a quarter of a tank,” he said, noting that mail carriers are responsible for sourcing and filling up their trucks. Two days ago, he’d filled up his truck, only to have to trade it out with another postal worker. The new truck he was given was on empty, causing him to spend 45 minutes hustling to five different stations before finding gas.
“This is not fun,” he said. When he inserts his Postal Service-issued fuel card repeatedly while trying different pumps, the card gets locked out. “We’re supposedly getting a new fleet next year, and half of them will be electric,” he said. “That will definitely help.”
Some signs of improvement surfaced overnight in Atlanta, Charlotte, and Raleigh, N.C., which were among the hardest-hit metro areas. Yellow bags denoting empty pumps just means easier parking for Jackie Aguila, who pulled up her Toyota at a Mount Pleasant pump while she finished a phone call before popping into the Circle K Exxon station. “I’m here for breakfast,” she said, plucking two plump hot dogs from the roller grill.
Aguila manages L.S. Castro Construction, a framing company based in Ladson, S.C., and typically has seven vehicles out on work sites each day, including one that her son Dorian drives.
“He lost three work hours yesterday looking for gas, and they only let him fill up $40 worth,” she said. “We also use gas compressors on our sites without electricity, so I’m worried about that, but so far, we’ve been okay.”
But as of Thursday morning, more than 70 percent of the stations in North Carolina remained dry, and states as far apart as Delaware and Kentucky were feeling the artificial crunch, according to Patrick De Haan, oil analyst for GasBuddy. The panic has driven U.S. gas demand up more than 11 percent so far this week, De Haan tweeted. The heightened demand pushed the national average for a gallon of gas to $3.02, up 8 cents from last week to reach its highest level since 2014, according to AAA.
Crude prices, meanwhile, appeared headed on Thursday for their biggest decline since April. Shortly before noon, West Texas Intermediate, the U.S. oil benchmark, was trading at $64.19 per barrel, down nearly 2.9 percent. Brent crude, the international benchmark, was down more than 2.5 percent to $67.56 per barrel.
Stock prices swooned marketwide amid the panic, before paring their losses somewhat on Thursday. The Dow Jones industrial average closed Thursday about 1.8 percent below where it was before the pipeline hack.
For Biden, the pipeline hack created a crisis out of left field as his administration is still fighting a persistent coronavirus pandemic and trying to revive an economy that is still feeling its effects.
The government took several measures this week that officials hoped would help alleviate the crisis. On Wednesday, Biden signed an executive order aimed at shoring up the federal government’s digital defenses to guard against future attacks like the one that tied up Colonial Pipeline.
And the Department of Homeland Security has authorized one non-American shipping company to aid U.S. ships in the transport of gasoline and jet fuel to help alleviate shortages in the Southeast. Under normal circumstances, only U.S.-crewed ships are allowed to transport goods between American ports under a law called the Jones Act.
The law was waived late Wednesday by Homeland Security Secretary Alejandro Mayorkas. Per his statement, just one company will be able to join the American ships that transport supplies from ports on the Gulf Coast to the East Coast.
“The decision to approve the waiver was made after careful consideration and consultation with interagency partners across the federal government,” Mayorkas said. “The Departments of Transportation, Energy, and Defense were consulted in order to assess the justification for the waiver request and ensure the approval of the waiver is in the interest of national defense.”
White House press secretary Jen Psaki said the move signals “an end in sight” for the supply disruptions rippling across the Southeast.
But the persistence of gasoline shortages ― and the systemic security vulnerabilities that were laid bare by the attack ― have already created a broader reckoning for the state of American infrastructure.
Biden’s remarks came amid a fierce political showdown over his handling of the situation, as Republicans opened a new line of attack against him on an issue that has long been fraught with political peril for the party that controls the White House.
Former Republican House speaker Newt Gingrich said on Fox News this week that a law should be passed immediately elevating this sort of attack to that of a terrorist attack, saying it should be subject to the death penalty. He bemoaned the country’s apparent inability to prevent or defend itself against an attack on home soil.
“We have no idea who [the attackers] are, we have no idea where they are, and if we did know who they were, we would have no mechanism to do anything about it,” Gingrich said. “A great country cannot allow people to come in and savage it, have no consequences, and then wait for the next attack. And that literally is where we are right now.”
Speaking during a Thursday appearance on CNBC’s “Squawk Box,” Buttigieg said the attack demonstrated a need to ensure “that we are harder targets for these kinds of cyber-actions.”
“I think for many Americans this has been a wake-up call on how actors anywhere in the world could impact us right here at home,” Buttigieg said. “And when you look at our political framework, our laws, a lot of them were not written for the cyber era.”
Buttigieg praised Biden’s Wednesday signing of an executive order aimed at strengthening the federal government’s digital defenses. The order comes at an important time, he said, and is “part of the bigger picture” of shoring up those defenses.
In the short term, the federal government has handled the crisis through such steps as issuing temporary weight limit waivers on tank trucks, Buttigieg said. He added that the comprehensive government response has “really paid off.”
Some leading security experts argued for large-scale changes to an energy system that is largely under private control. The defense of important energy infrastructure that millions rely on currently falls to corporate cybersecurity teams employed by energy companies such as Colonial.
There have been efforts in recent years to create a united front through industry-specific threat-sharing initiatives. But leading security experts have argued that the Department of Transportation should take a heavier hand in ensuring companies such as Colonial are properly defending themselves.
“This incident demonstrates that neither thoughts, prayers, nor information sharing is sufficient,” Rob Knake, industrial cybersecurity expert for the Council on Foreign Relations, wrote in a blog post Monday. “It is time for the federal government to exercise its existing authority to regulate the cybersecurity of pipelines.”
Brittany Shammas and Taylor Telford contributed to this report.