Federal Energy Regulatory Commissions looks to add cyber security requirements for pipelines

Fuel Fix:

If you have turned on the news or picked up a paper lately, you have probably seen reports that foreign enemies are increasingly launching cyber-attacks on America's critical infrastructure, including energy facilities. To address these threats, electric grid operators must comply with mandatory standards overseen by the Federal Energy Regulatory Commission (FERC) that protect against cyber and other attacks that threaten the reliability of our electric service.

Natural gas pipelines are not subject to similar standards. But given the increasing threats we face, the time has come to establish them for natural gas pipelines.

Abundant and affordable natural gas has facilitated a major shift in the United States' electric generation mix. The emergence of natural gas as a significant part of the fuel mix has greatly raised the stakes for pipeline cyber security.

Although FERC has the authority to issue certificates for new interstate gas pipelines and set their rates, the Commission does not have responsibility for pipeline security. That charge falls to the Transportation Security Administration, the same agency that is responsible for overseeing the security of 851 million aviation passengers per year, 138,000 miles of railroad track, and 4 million miles of highway.

In May 2017, TSA confirmed that it had just six full-time employees to oversee the security of the more than 2.7 million miles of natural gas, oil, and other hazardous liquid pipelines that traverse the country. In addition, although it has the authority to enforce mandatory standards to protect gas pipeline infrastructure from cyber-attacks, TSA has chosen to rely, instead, on voluntary standards.

Natural gas pipelines have a long history of providing reliable service. But given our growing dependence on natural gas in conjunction with the escalating potential for cyber-attacks, we cannot simply hope for the best.

In our view, Congress should vest the responsibility for pipeline security with an agency that fully comprehends the nation's energy sector and has sufficient resources to address the growing cyber security threat to gas pipelines. As the Sector-Specific Agency for energy security, the Department of Energy could be an appropriate choice. Such a move would be particularly timely given the Energy Department's recent announcement that it will be forming an office specifically focused on cybersecurity.

Regardless of where Congress vests this responsibility, the regulator must have the statutory authority, resources, and commitment to implement mandatory cybersecurity standards for gas pipelines. We will be the first to admit that mandatory standards are not a panacea.
...

This piece was written by FERC regulators.  I think the companies that operate pipelines have adequate incentives to protect their main income stream, but they might benefit from having some central standards to work with.  They would also benefit from having a central group that the various pipeline companies can brainstorm with and share information on what attacks they are dealing with and how best to deal with the attacks.

The US government has evidently developed some cybersecurity tools but fears using them because of potential retaliation.  This is the equivalent of having only nuclear weapons to defend yourself.  They may not be the right tool in the box for dealing with low-level attacks.  I think they need tools that immediately identify the source of the threat and allow the US to fry the computers used to attack US infrastructure.  That should be a goal of cyber security.