Colonial Pipeline CEO Joseph Blount testifies during a Senate Homeland Security and Government Affairs Committee hearing one day after the Justice Department revealed it had recovered the majority of the $4.4 million ransom payment the company made in hopes of getting its system back online, Tuesday, June 8, 2021, on Capitol Hill, in Washington. (Graeme Jennings/Pool via AP)

Pipeline CEO defends paying ransom amid cyberattack

Pipeline CEO defends paying ransom amid cyberattack

WASHINGTON (AP) — A pipeline company CEO on Tuesday defended his decisions to abruptly halt fuel distribution for much of the East Coast and pay millions to a criminal gang in Russia as he faced down one of the most disruptive ransomware attacks in U.S. history.

Colonial Pipeline CEO Joseph Blount said he had no choice, telling senators uneasy with his actions that he feared far worse consequences given the uncertainty the company was confronting as the attack unfolded last month.

“I know how critical our pipeline is to the country,” Blount said, “and I put the interests of the country first.”

His testimony to the Senate Homeland Security Committee on the May 7 cyberattack provided a rare window into the dilemma faced by the private sector amid a storm of ransomware attacks in which overseas hackers breach a company’s network and encrypt their data, demanding a ransom to release it back to them.

U.S. authorities tell companies not to pay the ransom, arguing the crooks may not provide the keys to unencrypt the data and that the payments will encourage future attacks and help sustain criminal networks typically based in Russia and Eastern Europe. Blount chose to disregard that advice within the first 24 hours of the attack and paid the equivalent of $4.4 million in bitcoin to retrieve the company’s data. U.S. officials said Monday they had recovered much of the payment.

“I made the decision to pay, and I made the decision to keep the information about the payment as confidential as possible,” Blount said. “It was the hardest decision I’ve made in my 39 years in the energy industry.”

The company, he said, was “deeply sorry” for the effect of the shutdown but had to act fast as it worked feverishly to determine whether the criminal gang had compromised the operational systems or physical security of the 5,500-mile pipeline — and to try to avoid a more sustained shutdown.

Asked how much worse it would have been if the company hadn’t paid to get its data back, Blount said, “That’s an unknown we probably don’t want to know. And it may be an unknown we probably don’t want to play out in a public forum.”

His appearance before the Senate comes as lawmakers consider possible measures to address the ransomware attacks that have been launched against thousands of businesses as well as state and local government agencies.

“We’ve got to recognize these ransomware attacks for what they are. It’s a serious national security threat,” said Sen. Rob Portman, a Republican from Ohio. “Attacks against critical infrastructure are not just attacks on companies. They are attacks on our country itself.”

Already, the Justice Department and FBI have established a task force to deal with ransomware with some success, including managing to seize 85% of the bitcoin that Colonial paid as ransom. But many of the criminals behind the attacks are beyond their reach in Russia or other countries that will not extradite suspects to the U.S.

The Biden administration has also made ransomware, and cybersecurity more broadly, a national priority in the wake of a series of high-profile intrusions.

Last month, the administration issued new regulations for the pipeline industry, requiring companies to conduct cybersecurity assessments and immediately report any breaches to the federal government. The industry has until now operated under voluntary guidelines.

Blount disputed a media report that his company had refused to participate in one of the voluntary assessments, conducted by the Transportation Security Administration, earlier this year, saying it had merely been delayed because of COVID-19 and other issues. “That was quite a shock to me,” he said of the account.

The attack on Colonial Pipeline — which supplies roughly 45% of the fuel consumed on the East Coast — has been attributed to a Russia-based gang of cybercriminals using the DarkSide ransomware variant, one of more than 100 variants the FBI is currently investigating.

It began after hackers accessed the company’s IT system through a virtual private network that was no longer in active use. Blount said it only required a “complicated” password to gain entry rather than multi-factor authentication, which provides additional security and is now required at Colonial.

“The ransomware attack on Colonial Pipeline affected millions of Americans, ” said Sen. Gary Peters, a Michigan Democrat. “The next time an incident like this happens, unfortunately, it could be even worse.”

Blount said the Georgia-based company began negotiating with the hackers on the evening of the May 7 attack and paid a ransom of 75 bitcoin — then valued at roughly $4.4 million — the following day. The hack prompted the company to halt operations before the ransomware could spread to its operating systems.

The encryption tool the hackers provided the company in exchange for the payment helped “to some degree” but was not perfect, with Colonial still in the process of fully restoring its systems while working with consultants to assess the damage and improve cybersecurity, Blount said.

It took the company five days to resume pipeline operations. What took place in that time illustrated why they needed to quickly pay the ransom, he told the lawmakers.

“We already started to see pandemonium going on in the markets, people doing unsafe things like filling garbage bags full of gasoline or people fist-fighting in line at the fuel pump,” he said. “The concern would be what would happen if it had stretched on beyond that amount of time.”

———

Follow Eric Tucker on Twitter at http://www.twitter.com/etuckerAP

Eric Tucker And Ben Fox, The Associated Press

 

Sen. Jon Ossoff, D-Ga., listens as Colonial Pipeline CEO Joseph Blount testifies during a Senate Homeland Security and Government Affairs Committee hearing one day after the Justice Department revealed it had recovered the majority of the $4.4 million ransom payment the company made in hopes of getting its system back online, Tuesday, June 8, 2021, on Capitol Hill, in Washington. (Andrew Caballero-Reynolds/Pool via AP)

Just Posted

The Sylvan Lake Gulls celebrate a sixth inning home run from Nolan Weger on Sunday during a game against the Edmonton Prospects. (Photo by BYRON HACKETT/Advocate Staff)
Historic opening weekend for Sylvan Lake Gulls

It wasn’t perfect, but perhaps that was the beauty of it. Fans… Continue reading

The Government of Alberta identified 115 new COVID-19 cases Sunday, bringing the provincial total to 3,089.
(Black Press file photo)
Alberta reports 100 new cases of COVID-19

The Central zone sits at 218 active cases

Three Hills RCMP recovered stolen copper wire during recent investigation near Kneehill. (File photo by Advocate staff)
Fatal ATV rollover near Innisfail Saturday

A 77-year-old man from Red Deer County died Saturday after an ATV… Continue reading

Firefighters and emergency services workers helped celebrate Barry Young’s 85th birthday at Timberstone Mews on May 29. (Photo by Sean McIntosh/Advocate staff)
Firefighters in central Alberta make birthdays special

A fire truck arriving outside your house is not normally good news.… Continue reading

A view of Two Jack Lake in Banff National Park is shown in this undated handout photo. More Canadians are expected to leave their passports at home this summer and hit the road in Canada as the weak loonie and low gas prices prompt a deeper exploration of their own country. THE CANADIAN PRESS/HO - Travel Alberta *MANDATORY CREDIT*
Report: Alberta losing residents to other parts of Canada

As the COVID-19 pandemic slowly winds down in Alberta, residents are continuing… Continue reading

A large number of supporters were out Saturday at a rally intended to bring awareness about including Hinduism in the grade 2 portion of the K-6 draft curriculum. As it stands now, Hinduism won’t be taught until grade 6 in the proposed draft curriculum. (Photo by BYRON HACKETT/Advocate Staff)
Video: Rally to support adding Hinduism to draft curriculum draws crowd in Red Deer

The Hindu community in Red Deer came out in droves on Saturday… Continue reading

Orange shirts, shoes, flowers and messages are displayed on the steps outside the legislature in Victoria, B.C., on Tuesday, June 8, 2021 following a ceremony hosted by the Songhees and Esquimalt First Nations in honour of the 215 residential school children whose remains have been discovered buried near the facility in Kamloops, B.C. THE CANADIAN PRESS/Chad Hipolito
Alberta city cancels Canada Day fireworks at site of former residential school

City of St. Albert says that the are where the display was planned, is the site of the former Youville Residential School

Barbara Violo, pharmacist and owner of The Junction Chemist Pharmacy, draws up a dose behind vials of both Pfizer-BioNTech and Oxford-AstraZeneca COVID-19 vaccines on the counter, in Toronto, Friday, June 18, 2021. An independent vaccine tracker website founded by a University of Saskatchewan student says just over 20 per cent of eligible Canadians — those 12 years old and above — are now fully vaccinated. THE CANADIAN PRESS/Nathan Denette
At least 20% of eligible Canadians fully vaccinated, 75% with one dose: data

Earlier projections for reopening at this milestone didn’t include Delta variant

This undated file photo provided by Ernie Carswell & Partners shows the home featured in the opening and closing scenes of The Brady Bunch in Los Angeles. Do you know the occupation of Mike Brady, the father in this show about a blended family? (Anthony Barcelo/Ernie Carswell & Partners via AP, File)
QUIZ: A celebration of dad on Father’s Day

How much do you know about famous fathers?

Germany's Robin Gosens, left, celebrates Germany's Mats Hummels after scoring his side's fourth goal during the Euro 2020 soccer championship group F match between Portugal and Germany at the football arena stadium in Munich, Saturday, June 19, 2021. (Matthias Hangst/Pool Photo via AP)
Germany clicks at Euro 2020 with 4-2 win over Portugal

MUNICH (AP) — Germany finally clicked into gear at the European Championship,… Continue reading

Fans cheer on their team during the pre-game warmup of Game 3 of the NHL Stanley Cup semifinal with the Montreal Canadiens facing the Vegas Golden Knights, in Montreal, Friday, June 18, 2021. THE CANADIAN PRESS/Paul Chiasson
COVID-19 concerns give way to Habs Fever in Quebec as Montreal continues playoff run

MONTREAL — The sun hadn’t yet risen in Montreal on Friday morning… Continue reading

Coronavirus cases are on the rise from India to South Africa and Mexico, in a May 19, 2020 story. (Photo by THE ASSOCIATED PRESS)
As Brazil tops 500,000 deaths, protests against president

RIO DE JANEIRO (AP) — Anti-government protesters took to the streets in… Continue reading

A black bear cub forages for food along a salmon stream below a bear viewing spot for tourists in the Mendenhall Glacier Recreation Area in Juneau, Alaska.  (File photo by THE ASSOCIATED PRESS)
Bandit responsible for vehicle break-ins is a black bear

THORNTON, N.H. (AP) — Surveillance video helped police get to the bottom… Continue reading

FILE - In this April 25, 2019 file photo, Editor Rick Hutzell, center, gives a speech to his staff including Chase Cook, Nicki Catterlin, Rachael Pacella, Selene San Felice and Danielle Ohl at the Capital Gazette in Annapolis, Md. The editor of the Capital Gazette, which won a special Pulitzer Prize citation for its coverage and courage in the face of a massacre in its newsroom, is leaving the Maryland newspaper. Hutzell, who worked at the Annapolis paper for more than three decades, authored a farewell column that was published on the paper's website Saturday, June 19, 2021. (Ulysses Muoz/The Baltimore Sun via AP)
Editor of paper that endured newsroom shooting says goodbye

ANNAPOLIS, Md. (AP) — The editor of the Capital Gazette, which won… Continue reading

Most Read