South Carolina orders price gouging statute | Long gas lines throughout Southeast

Also on Tuesday, U.S. Environmental Protection Agency Administrator Michael Regan issued fuel waivers for Washington, D.C., Maryland, Pennsylvania and Virginia through May 18, 2021.

The Clean Air Act allows Regan, in consultation with the Department of Energy, to waive certain fuel requirements to address shortages. As a result of the shutdown, Regan’s office said he determined extreme and unusual fuel supply circumstances exist and has granted a temporary waiver to help ensure that an adequate supply of gasoline is available in the affected areas until normal supply can be restored.

While U.S. officials sought to soothe concerns about price spikes or damage to the economy by stressing the fuel supply had so far not experienced widespread disruptions, reports were being circulated on social media of just the opposite.

Stations from Virginia to Florida and Alabama, according to Bloomberg, are reporting they’ve sold out of gasoline. About 7% of gas stations in Virginia were out of fuel as of late Monday, according to GasBuddy.

The U.S. DOT eased restrictions on motor carriers and drivers for those carrying gasoline, diesel, jet fuel and other refined petroleum products to Alabama, Arkansas, District of Columbia, Delaware, Florida, Georgia, Kentucky, Louisiana, Maryland, Mississippi, New Jersey, New York, North Carolina, Pennsylvania, South Carolina, Tennessee, Texas, Virginia and West Virginia.

On Monday, the White House said President Joe Biden continues to be regularly briefed on the incident.

“The Administration is continually assessing the impact of this ongoing incident on fuel supply for the East Coast,” the White House said in a statement. “We are monitoring supply shortages in parts of the Southeast and are evaluating every action the Administration can take to mitigate the impact as much as possible.”

“We need to invest to safeguard our critical infrastructure,” Biden said Monday. Energy Secretary Jennifer Granholm said the attack “tells you how utterly vulnerable we are” to cyberattacks on U.S. infrastructure.

Colonial Pipeline, which delivers about 45% of the fuel consumed on the East Coast and is headquartered in Alpharetta, halted operations last week after revealing a ransomware attack that it said had affected some of its systems.

Georgia, Florida, Alabama, South Carolina, North Carolina and Tennessee rely on the line for most of their fuel supplies.

Demand in some states served by the pipeline — including Alabama, Florida, Georgia and Tennessee — rose about 4.3% on Saturday compared with a week earlier, Patrick De Haan, head of petroleum analysis at fuel tracking firm GasBuddy, said.

De Haan said drivers should avoid panic buying.

“Panic buying or hoarding of gasoline will prolong outages and price spikes, making them much worse,” he said. “It is true that if the pipeline remains out of service into the early part of next week, roughly Tuesday or so, that some gas stations may run low on gasoline. Tank farms that take the gasoline from the pipeline are likely starting to see supply run low, so it is vital that motorists do not overwhelm the system by filling their tanks.

“Rushing out and filling your tank will make the problem much much more acute and likely double or triple the length of any supply event, if it comes to that,” he said.

Gas prices have risen a cent on the gallon since Friday, said the American Automobile Association.

“If the interruption persists, we will see more regional impacts than nation-wide, in terms of supply and prices. The south/southeast (Maryland to Mississippi to Georgia), will likely see gas prices increase first,” the AAA said in a statement to Reuters.

The attack came as the administration, still grappling with its response to massive breaches by Russia of federal agencies and private corporations, works on an executive order aimed at bolstering cybersecurity defenses.

The Justice Department, meanwhile, has formed a ransomware task force designed for situations just like Colonial Pipeline, and the Energy Department on April 20 announced a 100-day initiative focused on protecting energy infrastructure from cyber threats. Similar actions are planned for other critical industries, such as water and natural gas.

The FBI publicly assigned blame Monday by saying the criminal syndicate whose ransomware was used in the attack is named DarkSide. The group’s members are Russian speakers, and the syndicate’s malware is coded not to attack networks using Russian-language keyboards.

Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, said at a briefing that the group has been on the FBI’s radar for months. She said its business model is to demand ransom payments from victims and then split the proceeds with the ransomware developers, relying on what she said was a “new and very troubling variant.”

She declined to say if Colonial Pipeline had paid any ransom, and the company has not given any indication of that one way or the other. Though the FBI has historically discouraged victims from making payments for fear of promoting additional attacks, she acknowledged “the very difficult” situation that victims face and said the administration needs to look “thoughtfully at this area” of how best to deter ransomware.

“Given the rise in ransomware, that is one area we’re definitely looking at now to say, ‘What should be the government’s approach to ransomware actors and to ransoms overall?’”

Speaking later in the day at a conference on national security, Neuberger said the administration was committed to leveraging the government’s massive buying power to ensure that software makers make their products less vulnerable to hackers.

“Security can’t be an afterthought,” Neuberger said. “We don’t buy a car and only then decide if we want to pay for seatbelts and airbags.”

The U.S. sanctioned the Kremlin last month for a hack of federal government agencies, known as the SolarWinds breach, that officials have linked to a Russian intelligence unit and characterized as an intelligence-gathering operation.

In this case, though, the hackers are not known to be working at the behest of any foreign government. The group posted a statement on its dark web site describing itself as apolitical. “Our goal is to make money, and not creating problems for society,” DarkSide said.

Asked Monday whether Russia was involved, Biden said, “”I’m going to be meeting with President (Vladimir) Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there is evidence that the actors, ransomware, is in Russia.

“They have some responsibility to deal with this,” he added.

Colonial is in the process of restarting portions of its network. It said Monday that it was evaluating the product inventory in storage tanks at its facilities. Administration officials stressed that Colonial proactively took some of its systems offline to prevent the ransomware from migrating from business computer systems to those that control and operate the pipeline.

In response to the attack, the administration loosened regulations for the transport of petroleum products on highways as part of an “all-hands-on-deck” effort to avoid disruptions in the fuel supply.

Granholm, the Energy secretary, said “Cyber attacks on our critical infrastructure — especially energy infrastructure — is not going away.”

“This is a serious example of what we’re seeing across the board in many places, and it tells you that we need to invest in our systems, our transmission grid for electricity. We need to invest in cyber defense in these energy systems,” she told Bloomberg TV.

The Associated Press contributed to this report.