US pressed to improve offshore oil cybersecurity

The US should immediately issue plans to protect offshore oil and gas facilities from cyberattacks that could disrupt production or cause an offshore spill, a federal watchdog agency has found.

The US Interior Department's Bureau of Safety and Environmental Enforcement (BSEE) so far has taken few steps to address cybersecurity risks for the more than 1,600 oil and gas facilities located offshore, even though a successful cyberattack could have "catastrophic effects" including deaths, injuries, environmental damage and harm to the economy, says the new report from the US Government Accountability Office.

Oil and gas companies are frequent targets for cyberattacks, both from individual hackers and state actors. A ransomware group last year hacked into the 5,500-mile Colonial Pipeline products pipeline, triggering its temporary closure and obtaining a $4.4mn payment from the company.

BSEE first identified the need to work on cybersecurity issues for the offshore oil and gas sector in 2015 but has made little progress on the issue since then, the report said. The agency hired a cybersecurity specialist earlier this year, but a formal program is in the "very early stages," and the agency does not expect to make key decisions until the fiscal year that begins next October, the report said.

The Interior Department largely agreed with the findings and recommendations, the report said. BSEE did not immediately respond to a request for comment on the report.

By Chris Knight