On Friday, May 7th, a ransomware attack on Colonial Pipeline’s corporate information technology (IT) networks disrupted fuel distribution across the eastern coast of the United States (US). Colonial’s pipeline system is over 5,500 miles long, running from Houston, Texas to New York Harbor, New York. The attack – cited as the most disruptive cyberattack on energy infrastructure in US history – and subsequent shut down caused 17 states – across four Federal Emergency Management Agency (FEMA) regions – to declare states of emergency due to fuel shortages, most acutely within southeastern states. The pipeline has since resumed normal activities; however, this event highlighted both the challenges associated with responding to petroleum shortages and the importance of coordination across regions, states, and private sector entities before, during, and after shortage incidents.
Source: Colonial Pipeline Company
As referenced in our previous blog post on the attack, Colonial Pipeline worked with federal, state, and local agencies in a whole-of-government response to restore service as quickly as possible; however, fuel distribution networks do not follow the boundaries of established regions or states, and response actions taken in one state or region can impact neighboring jurisdictions. While each state likely has their own energy assurance plans, with provisions for petroleum shortage incidents that are informed by national-level guidance, the Colonial Pipeline incident reinforced the way in which impacts span jurisdictional boundaries.
Over the past few years, Hagerty has been working with the US Department of Energy (DOE), the National Emergency Management Association (NEMA), and the National Association of State Energy Officials (NASEO) on a series of projects with states across the country to account for the cascading effects of petroleum disruptions and to improve collective responses to petroleum shortages by building coordination across states, regions, and the private sector.
Hagerty, NEMA, and NASEO: Addressing the Call for Regional Coordination
Southeastern US Petroleum Shortage Planning Workshop
In 2017, NEMA and NASEO began an effort to address regional petroleum shortage coordination under a cooperative agreement with US DOE. Hagerty was added to the team to help plan and facilitate the February 2018 NEMA NASEO DOE Petroleum Shortage Response Planning Workshop in Atlanta. The workshop brought together representatives from 12 states, federal agencies, associations, and the oil and natural gas industry to define the current capacity and practices for petroleum shortage response. The workshop’s goal was to enhance regional petroleum shortage response coordination to bolster the overall energy resilience of the southeastern quadrant of the US. NASEO’s Guidance for States on Petroleum Shortage Response Planning served as the foundation for the workshop, giving participants the opportunity to not only become familiar with the guidance, but also provide feedback on additional guidance and data needs. During the workshop, participants identified areas for future planning and existing promising practices, including considerations for areas such as public information, external coordination, data and evaluation, regional coordination methods, and prioritization/allocation decision-making (see here for the workshop summary).
One key aspect from this and subsequent workshops is the criticality of public information during a petroleum shortage. What the media communicates to the public greatly influences how people will react to the incident. State energy offices and emergency management should be the primary drivers of the messages being released.
Western US Petroleum Shortage Workshop
After the success of the Southeast workshop, NEMA, NASEO, DOE, and Hagerty shifted their focus to the west coast, seeking to understand its state of readiness and potential foundations for regional petroleum shortage response coordination. Hagerty coordinated a workshop in 2019 that brought together representatives from 10 coastal and inland states in the western US, federal agencies, and industry to tackle the same challenges as their counterparts previously did in the southeast – seeking to facilitate the development of stronger, more coordinated petroleum shortage response plans. The workshop generated similar insights to those of the southeast, as well as a strong desire to begin enhancing regional coordination for petroleum shortages (see here for the workshop summary).
Western Petroleum Shortage Response Collaborative (WPSRC) Initiative
Given the high level of interest generated throughout the western states during the workshop in 2019, Hagerty is currently supporting DOE, NASEO, and NEMA in the formation of a Western Petroleum Shortage Response Collaborative (WPSRC). The Collaborative initiative is focused on facilitating the coordination and development of a regional petroleum shortage response framework among a subset of western states and building upon the lessons learned from the 2019 workshop.
The WPSRC is the first official working group in the western US comprised of key players with both energy and emergency management expertise. These leaders have the unique task of planning for regional catastrophic fuel shortages. WPSRC members have benefitted from deliberate examination, dissection, and cross-referencing of existing western state and regional response plans, concepts, and annexes, and will leverage peer expertise to improve respective state plans while working toward a regional framework. Upon project completion, WPSRC participants will have access to a new regional fuel response framework, insights for enhanced state emergency fuel plans, and a developed network collaborative of trusted, established partners that can be leveraged for future regional planning initiatives and during real-world events. NEMA, NASEO, DOE, and Hagerty will also use the framework as the basis for a template and guidance that they will make available to other regions in the US to facilitate similar collaborative efforts.
NEMA Petroleum Shortage Pilot Exercise
Findings from the petroleum shortage workshops identified the need to develop and test more robust state-level incident response plans for petroleum disruptions. As part of the WPSRC initiative, NEMA selected a member state for a pilot petroleum shortage exercise and Hagerty is currently working with this state to develop and execute a tabletop exercise that will assess participants’ response to a petroleum shortage. The scenario is based on an earthquake that disrupts the primary supply of petroleum, subsequent cyberattacks on petroleum terminals that limit the use of stored reserves and cyberattacks on IT systems the state emergency operations center (EOC) uses to coordinate operations.
While this exercise will help improve operational coordination within the state and with their private sector partners, the workshops and, most recently, the Colonial Pipeline incident have demonstrated the continued need for planning, training, and exercises that test plans and procedures for real-time, regional coordination across jurisdictions.
What’s Next?
As both natural and manmade threats to critical infrastructure continue to rise, so too will the need for regionally coordinated responses to incidents and disruptions; however, the energy sector is not the only critical infrastructure sector vulnerable to these hazards. Earlier this week, computer networks at JBS – the world’s largest meat supplier – were hacked, temporarily shutting down some operations in the US, Australia, and Canada.
In the wake of these recent, high-profile attacks on critical US infrastructure, state and local governments as well as private companies are acknowledging the need for increased security measures and enhanced regional coordination and are making progress to better understand their risks – this includes formalizing regional partnerships to protect against future shortages and lifeline disruptions. While establishing these partnerships is critical, it is just the beginning. State and local governments, and their private sector partners, will need to exercise their regional coordination plans, continue to expand their partnership networks, and train relevant staff on how to execute continuity of operations plans and procedures to ready themselves for potential future incidents to come.
Hagerty Can Help
Hagerty has the experience and expertise to support organizations in cybersecurity preparedness and infrastructure resilience efforts, as well as petroleum shortage planning, business continuity, and Continuity of Operations (COOP). We stand ready to help with your organization’s assessment, planning, training, and exercise needs to enhance cybersecurity and emergency response strategies. Contact us to learn more about our cybersecurity, energy sector, and COOP offerings and capabilities.
Rob Denaburg is a Senior Managing Associate in Hagerty’s Preparedness Division. Rob serves as a lead in Hagerty’s Critical Infrastructure Preparedness work, with a focus on energy. Rob has worked with public and private sector clients to minimize the societal, economic, and national security impacts of infrastructure outages and build resilience against severe natural and manmade hazards.
Ashley Wargo is a Senior Managing Associate in the Preparedness Division out of Hagerty’s Austin, TX office. Ashley serves as the firm’s lead for energy preparedness, working with clients at local, state, and national levels to enhance preparedness efforts through planning, training, exercise, and operations analysis. She works with clients to gather actionable information that can be used to formulate and prioritize improvement actions to enhance response efficiency and service delivery to municipalities and customers.
WANT TO STAY IN THE KNOW?
Subscribe to our monthly Disaster Discourse Newsletter below.