Critical Infrastructure Protection: Key Pipeline Security Documents Need to Reflect Current Operating Environment
Released: 2019-06-05T00:00:00

Letter

Background

Overview of U.S. Pipeline System

The national pipeline system consists of more than 2.7 million miles of networked pipelines transporting natural gas, oil, and other hazardous liquids. Natural gas and hazardous liquid pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely-populated areas. There are three main types of pipelines based on the types of materials transported:

Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide.

Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities.

Natural gas distribution: About 2.2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers.

Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States.

More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U.S. borders with Canada and Mexico. Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers. Most pipeline systems are monitored through automated industrial control systems or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within established tolerance levels.

Threats to Pipeline Safety and Security

Pipeline accidents can occur from a variety of causes, including third- party excavation, corrosion, mechanical failure, control system failure, and operator error. Natural forces, such as floods and earthquakes, can also damage pipelines. Although pipeline releases have caused relatively few fatalities, a single pipeline accident can be catastrophic in terms of public safety and environmental damage. Figure 2 shows notable pipeline accidents since September 2010.

According to TSA, pipelines are also vulnerable to physical attacks by crude or unsophisticated tactics, such as rudimentary explosives, arson, or equipment sabotage—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas. Threats to the nation’s pipeline systems include sabotage by activists, physical attack by terrorists, and cyber attack or intrusion by nations. In October 2016, environmental activists forced the shutdown of five crude oil pipelines in four states: Minnesota, North Dakota, Montana, and Washington State. Further, in January 2019, the Director of National Intelligence stated that China has the ability to launch cyber attacks that have caused localized, temporary disruptive effects on critical infrastructure—such as disruption of a natural gas pipeline for days to weeks—in the United States.

Key Critical Infrastructure Protection Guidance and Presidential Directives

Federal policy and public-private plans establish the roles and responsibilities for the protection of critical infrastructure, including pipelines. These policies and public private plans include Presidential Policy Directive /PPD-21 (PPD-21) and the National Infrastructure Protection Plan (NIPP). PPD-21, issued in February 2013, was developed to advance a national unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure, which includes pipelines. PPD-21 reflects an all-hazards approach to protecting critical infrastructure, by accounting for the protection of critical infrastructure from natural or manmade threats or incidents. Examples of threats or incidents include natural disasters, cyber incidents, industrial accidents, pandemics, acts of terrorism, sabotage, and destructive criminal activity targeting critical infrastructure. PPD-21 also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each sector among nine designated federal sector-specific agencies as shown in Figure 3.

While PPD-21 identifies the critical infrastructure sectors and assigns responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience. The NIPP describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector. For example, DHS and DOT are designated as co-sector-specific agencies for the transportation systems sector, which includes pipelines. Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations. For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has also been established to represent pipeline operators.

Pipeline Stakeholder Roles and Responsibilities

Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry. As a result, several federal departments, agencies, and the private sector have significant roles in pipeline safety and security. The entities primarily responsible for pipeline safety and security are included below.

Transportation Security Administration (TSA). TSA has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems. Within TSA, the Policy, Plans, and Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program. Pursuant to the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/11 Commission Act), TSA’s Pipeline Security Branch issued voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018. Further, in accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch also identifies the top 100 critical pipeline systems in the nation. TSA also ranks the relative risk among these top 100 systems. Additionally, the Pipeline Security Branch is responsible for conducting voluntary security reviews, which assess the extent to which these 100 pipeline systems are following the intent of TSA’s Pipeline Security Guidelines.

Pipeline and Hazardous Materials Safety Administration (PHMSA). PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which may relate to pipeline security. PHMSA develops regulations for domestic interstate and intrastate natural gas and hazardous liquid pipelines. Its regulatory programs are focused on ensuring safety in the design, construction, operation, and maintenance of pipelines. Under PHMSA’s pipeline safety program, pipeline operators have primary responsibility for ensuring the integrity of their pipelines. PHMSA and some state pipeline safety offices are responsible for conducting inspections to oversee operators’ compliance with federal pipeline safety regulations and other federal requirements. Inspectors from PHMSA’s five regional offices and states are responsible for inspecting nearly 3,000 companies that operate 2.7 million miles of pipelines.

Private sector. Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector and publicly-owned pipeline operators are responsible for implementing asset-specific protective security measures. As we previously reported, since the September 11th terrorists attacks, operators have increased their attention on security by incorporating security practices and programs into their overall business operations. Pipeline operators’ interests and concerns are primarily represented by five major trade associations—the Interstate Natural Gas Association of America, American Gas Association, American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines. According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing.

MOU Annex Delineates Pipeline Security Roles and Responsibilities But Has Not Been Reviewed to Consider Pipeline Security Developments Since 2006

MOU Annex Delineates Pipeline Security and Safety Roles and Responsibilities

The MOU Annex delineates TSA and PHMSA mutually agreed-upon pipeline security roles and responsibilities, consistent with their respective missions, and acknowledges that both agencies benefit by sharing each other’s expertise, among other things. Specifically, the MOU Annex identifies 11 program areas, where TSA and PHMSA agreed to coordinate their respective roles and responsibilities. The first program area for example, calls for both agencies to coordinate efforts to identify critical infrastructure, and to share relevant data and observations found during respective safety inspections and security assessments. Another program area addresses coordination in developing transportation security standards, regulations, guidelines, or directives. The MOU Annex further provides that TSA and PHMSA are to seek early and frequent coordination in developing such standards, regulations, guidelines, or directives. They are also to review the adequacy of existing standards in the private and public sector, and identify any gaps that should be addressed through rulemaking, guidelines, or directives, among other items. For a complete listing of the MOU Annex’s 11 program areas, including TSA and PHMSA roles and responsibilities and agreed-upon actions, see appendix I.

TSA and PHMSA Do Not Have Timeframes for Reviewing the MOU Annex to Assess Pipeline Security Roles and Responsibilities

TSA and PHMSA have both noted various developments that have occurred since 2006 that may affect their roles and responsibilities related to pipeline security. However, the MOU Annex has not been updated since its inception in 2006 to consider incorporating these changes which includes subsequently issued presidential directives, the establishment of the Cybersecurity Infrastructure and Security Agency (CISA), and distinctions between current TSA and PHMSA current inspection operations. As a result, the Annex is not current and may not fully reflect the agencies’ pipeline safety and security-related activities. For example, Homeland Security Presidential Directive/HSPD-7 (HSPD-7), which is cited as an underlying authority in both the 2004 MOU and 2006 MOU Annex was revoked and replaced by PPD-21 in 2013. According to PPD-21, the directive advances a national unity of effort to strengthen and maintain secure, functioning, and resilient critical infrastructure by, among other things, refining and clarifying critical infrastructure-related functions, roles, and responsibilities across the federal government. PPD- 21 further provides, however, that plans developed pursuant to HSPD-7 shall remain in effect until specifically revoked or superseded. According to TSA and PHMSA officials, statements of Executive Branch policy including presidential directives such as PPD-21 include changes that could impact their pipeline security and safety roles and should be considered in any future revisions to the MOU Annex.

Further, PHMSA officials also told us that TSA and PHMSA’s roles and responsibilities in identifying critical infrastructure should be reviewed given the establishment of the CISA in November 2018. CISA, formerly the DHS National Protection and Programs Directorate, is responsible for, among other things, coordinating a national effort to secure and protect against critical infrastructure risks. These responsibilities include coordinating with sector-specific agencies to carry out its cybersecurity and critical infrastructure activities. TSA and PHMSA officials stated that they have closely coordinated in identifying critical infrastructure when responding to past national emergencies. For example, TSA identified and provided PHMSA with information on the pipelines that supplied fuel to specific airports during the hurricane seasons in 2017 and 2018. However, PHMSA officials stated that both TSA and PHMSA should consider reviewing how these types of efforts may need to be coordinated with CISA in the future and whether any adjustments to respective roles and responsibilities in the MOU Annex are needed. In addition, representatives from all of the industry associations that we interviewed stated that the agreement should be revised to consider how the establishment of CISA may impact current TSA and PHMSA pipeline security roles and responsibilities. TSA officials stated that they do not believe that the establishment of CISA impacts TSA’s roles and responsibilities for identifying pipeline critical infrastructure. While CISA may or may not have impacts on TSA and PHMSA’s pipeline security roles, reviewing the MOU Annex in light of new developments, such as the CISA, would allow the TSA and PHMSA to determine whether updates are necessary.

TSA and PHMSA officials stated that distinctions in current inspections and enforcement operations necessitate a revision to the MOU Annex. The MOU Annex states that agencies are to explore opportunities for collaboration in inspection and enforcement activities. According to TSA and PHMSA officials, they have since explored the possibility for conducting joint activities and found that distinctions in their respective operating environments and roles and responsibilities do not allow for joint inspection and enforcement activities. For example, PHMSA conducts physical inspections of facilities to assess pipeline operators’ compliance with pipeline safety regulatory requirements and relies on a range of enforcement activities, such as civil penalties to ensure that pipeline operators correct safety violations and prevent safety problems. TSA, however, conducts voluntary security assessments of pipeline’s corporate security programs and critical facilities and relies on pipeline operators’ willingness to participate and implement recommended changes to improve pipeline security. As a result, TSA and PHMSA officials stated that pipeline operators are reluctant to participate in a voluntary assessment that might include PHMSA inspectors because they represent a regulatory agency. TSA, PHMSA and industry association representatives we interviewed agreed that the annex should be updated to accurately reflect current distinctions in the agencies’ roles and responsibilities and their respective operating environments.

PHMSA officials stated that they had planned to review the MOU Annex in 2018 to assess current roles and responsibilities and determine whether any updates to the MOU Annex were needed, but efforts were delayed because of competing priorities such as addressing the aftermath of major hurricanes in 2017 and 2018. Specifically, TSA and PHMSA had agreed to an initial list of timeframes for reviewing the MOU Annex and these timeframes called for the agencies to complete the MOU Annex revision in 2018. However, as of March 2019, TSA and PHMSA have yet to complete the review and although both agencies stated that the review is ongoing, neither agency could provide updated timeframes for completion. Furthermore, while the Annex recognizes that TSA and PHMSA may propose agreed-upon amendments or modifications to the agreement, it does not call for regular or periodic reviews to identify whether any updates or revisions are needed and, as appropriate, implemented.

TSA and PHMSA officials, as well as the industry association representatives we interviewed all reported that the MOU Annex helped to coordinate pipeline security and safety efforts because: (1) it is a signed written agreement that can be readily consulted; (2) it memorialized respective TSA and PHMSA roles and responsibilities for government leaders and staff at the time; and (3) it can be modified or amended as needed.

Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. In addition, documentation of any changes made as a result of such reviews, such as changes to an entity’s roles and responsibilities or in technology, should occur to ensure that such controls are clear over time as staff change within an organization. Standards for project management state that managing a project involves, among other things, developing a timeline with milestone dates to identify points throughout the project to reassess efforts under way to determine whether project changes are necessary. By developing and implementing mutually agreed upon time frames for reviewing the annex and updating it, as appropriate, TSA and PHMSA could better ensure that the roles and responsibilities for TSA and PHMSA remain current. Additionally, including a provision in the annex for periodically reviewing for needed updates would help ensure the agreement consistently reflects relevant and updated information on TSA and PHMSA’s roles and responsibilities.

TSA and PHMSA Communicate Their Roles through Guidelines and Other Methods, and Selected Industry Stakeholders Reported the Agencies’ Roles Are Clear

TSA and PHMSA have communicated their respective pipeline safety and security roles and responsibilities by issuing pipeline security guidance and safety regulations, issuing a joint advisory bulletin, and maintaining informal contacts with pipeline stakeholders when conducting outreach activities, pipeline security assessments, or safety inspections.

TSA security guidelines. TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and revised them in March 2018. The guidelines include TSA’s recommendations for pipeline industry security practices, such as establishing a corporate security program, conducting security vulnerability assessments, and identifying critical facilities. The guidelines also recommend facility security and cybersecurity measures, which serve as the basis for the pipeline security assessments conducted by TSA’s Pipeline Security Branch.

PHMSA regulations. PHMSA’s Office of Pipeline Safety issues and enforces intrastate and interstate regulations covering aspects of pipeline safety, including the design, construction, operation and maintenance, and spill response for hazardous liquid and gas pipeline facilities, including liquefied natural gas facilities.

Advisory bulletins. PHMSA also issues advisory bulletins to communicate safety-related conditions to pipeline operators, and can issue advisory bulletins in coordination with TSA to notify pipeline operators of a security incident. Such bulletins may include identifying the affected operators, describing the threat, and providing information on federal resources for assistance. For example, in response to physical intrusions on pipelines and a coordinated campaign by domestic saboteurs, and to remind pipeline operators of the importance of safeguarding and securing their pipelines from physical and cyber intrusion or attack, PHMSA, in coordination with TSA, issued an advisory bulletin in 2016. The bulletin also included a brief discussion of TSA’s and PHMSA’s roles on pipeline safety and security.

Forums and routine interactions with operators. TSA and PHMSA officials also reported that they communicate their agencies’ respective roles and responsibilities for pipeline safety and security to stakeholders when conducting general outreach, information sharing efforts, or inspections or assessments. TSA and PHMSA officials noted that these activities provide opportunities for agency officials and pipeline stakeholders to clarify their roles and responsibilities should pipeline operators have questions. Examples of such community outreach activities include attending meetings of the Oil and Natural Gas subsector SCC or the Pipeline Modal SCC, and TSA’s annual International Pipeline Security Forum. TSA officials also said that TSA’s monthly and quarterly unclassified threat briefings provided TSA officials and pipeline stakeholders the opportunity to discuss and clarify their roles and responsibilities. Additionally, TSA produces classified and unclassified threat assessments on physical and cyber threats to pipelines, which according to agency officials can help to clarify TSA’s security role. Finally, TSA and PHMSA officials said that pipeline security assessments and safety inspections and other enforcement activities that the agencies regularly conduct are also opportunities to communicate their roles and responsibilities. For example, TSA officials reported that should an operator ask for assistance regarding a safety issue while TSA staff was conducting a security review, TSA staff would be able to refer the operator to PHMSA to address the issue. Similarly, PHMSA officials stated that inspectors would refer an operator to TSA or its pipeline security guidelines should the operator have questions regarding, for example, what security measures to implement.

The representatives of the four pipeline associations we interviewed reported that TSA and PHMSA had clearly communicated their respective roles and responsibilities to pipeline stakeholders. Specifically, all of the association representatives said that their membership understood that TSA is responsible for pipeline security matters and PHMSA is responsible for pipeline safety matters. For example, one industry association representative stated that they had contacted their members to determine whether they were unclear regarding TSA’s and PHMSA’s respective roles and responsibilities and that members reported the roles were clear to them. Further, another association representative reported that the initial security reviews and outreach efforts that TSA conducted after the pipeline security program was created helped pipeline operators to understand that its role was to oversee pipeline security. In addition, all of the association representatives we interviewed stated that the MOU Annex helped ensure that TSA and PHMSA understood and respected each other’s roles and responsibilities. As a result, according to the association representatives, their pipeline operator membership had not experienced challenges associated with overlapping or duplicative efforts on the part of TSA and PHMSA pipeline safety or security programs.

TSA Communicated Pipeline Incident Response Protocols in Its 2010 Plan, but Has Not Updated the Plan to Address Changes in Key Areas

TSA Has Established a Pipeline Incident Response Protocol Plan That Communicates Agencies’ Roles and Responsibilities During Pipeline Incidents

In accordance with the 9/11 Commission Act, TSA issued its Pipeline Security and Incident Recovery Protocol Plan in March 2010. The plan’s stated intent is to establish a comprehensive interagency approach to counter risks, coordinate federal agencies’ actions, and minimize the consequences of incidents involving pipeline infrastructure as well as recovery time from them. The plan also defines the roles and responsibilities of federal agencies; tribal, state, and local governments; and the private sector during a pipeline incident. It also defines the measures they may take related to pipeline infrastructure security incidents. According to the plan TSA, PHMSA, the Department of Energy (DOE), and the Federal Bureau of Investigation (FBI) have principal roles in pipeline incident response, while other agencies such as the U.S. Coast Guard, the Federal Emergency Management Agency (FEMA), and the National Transportation Safety Board (NTSB) have supporting roles. The following are examples of agencies’ roles and responsibilities in each of the plan’s three response phases.

Prevention/protection. TSA is responsible for monitoring pipeline owner and operators’ implementation of its pipeline security guidelines, and PHMSA is responsible for enforcing its pipeline safety regulations. TSA, in addition to the FBI, is responsible for assessing the credibility of any physical or cyber threat information it receives and sharing any intelligence related to pipeline security with pipeline owners and operators.

Response. TSA is responsible for coordinating information sharing between federal agencies and pipeline stakeholders, and PHMSA is responsible for coordinating federal agency activities with the affected pipeline operator and state pipeline safety agency. The plan also states that the FBI is responsible for investigating attempted or successful attacks on pipeline infrastructure including those that are believed to have a nexus to terrorism.

Recovery. PHMSA is primarily responsible for working with the pipeline operator, along with other supporting federal agencies, to facilitate service restoration. DOE is responsible for monitoring flows of throughput in the affected pipeline system or systems, assessing regional, national, and global impacts of an incident on energy infrastructure throughout all three phases.

Appendix I provides more details on key federal agencies’ and pipeline operators’ roles and responsibilities, as well as the actions they may take in response to an incident as detailed in the plan.

TSA Has Not Updated Its Incident Response Plan to Address Changes in Pipeline Security Threats, Technology, and Federal Laws and Policies

TSA’s plan states that it will be updated periodically to address changes in pipeline security threats, technology, and federal laws and policies. Further, Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. In addition, internal control standards also states that changes in an entity’s programs or activities, organizational structure, personnel, or technology can affect the operating environment and management can respond by revising internal controls on a timely basis to ensure effectiveness. However, TSA has not reviewed or revised its 2010 plan to ensure it addresses changes in at least three key areas: cybersecurity-related laws and policies, incident management policies, and DHS’s terrorism alert system as described below.

TSA’s 2010 plan includes some discussion of cyber threats and refers operators to guidance they may use to better secure their SCADA and control systems. However, the plan does not identify the cybersecurity roles and responsibilities of federal agencies that are identified in the plan, such as DOE, Federal Energy Regulatory Commission (FERC), or the FBI, or discuss the measures these agencies should take to prevent, respond to, or support pipeline operators following a cyber incident involving pipelines.

TSA’s 2010 plan also has not been updated to reflect current cybersecurity incident response guidance. In December 2016, DHS issued its National Cyber Incident Response Plan (NCIRP). The NCIRP is to be the primary framework for stakeholders, including pipeline operators, to understand how federal departments and agencies provide resources to support response operations for a significant cyber incident. NCIRP identifies the FBI and the National Cyber Investigative Joint Task Force as responsible for investigating reported cyber incidents. NCIRP also identifies the National Cybersecurity and Communications Integration Center (NCCIC), an agency within DHS, as responsible for providing technical assistance to affected entities, such as pipelines, to mitigate vulnerabilities and reduce impacts of cyber incidents. NCCIC is also to share information across the public and private sectors to protect against similar incidents in the future.

In addition, NCIRP provides guidance detailing when and to which federal agencies or entities the public should report a cyber incident. These include the FBI, the National Cyber Investigative Joint Task Force, U.S. Secret Service, and NCCIC. For example, NCIRP states that any cybercrime—including computer intrusions or attacks, theft of trade secrets, criminal hacking, terrorist activity, espionage, sabotage, or other foreign intelligence activity—is to be reported to FBI field offices’ cyber task forces. However, TSA’s plan does not include this information or describe what measures, if any, the agencies with pipeline-related roles and responsibilities listed in NCIRP are to take in response to a pipeline cyber incident.

Moreover, the 2010 plan does not account for other agencies whose roles and responsibilities are related to critical infrastructure, such as pipelines and cybersecurity. Specifically, the plan does not account for the role of NCCIC, which was established in 2009. In addition, TSA’s 2010 plan does not account for CISA’s role in cyber threat response activities or how it may affect other agencies’ roles and responsibilities for pipeline incident response.

TSA officials acknowledged that reviewing and, as appropriate, revising the plan would be beneficial to ensuring the plan addresses current pipeline security threats, technology, and federal laws and policies. They stated TSA had not updated the plan to include cybersecurity response protocols because an overarching cybersecurity response protocol for all critical infrastructure sectors—not just pipelines—should first be developed. According to TSA officials, developing a pipeline cybersecurity response protocol would require a whole-of-government approach, as well as coordination with private sector and input from many sectors because of the challenges and complexity of critical infrastructure cybersecurity in general.

However, through NCIRP, DHS provided a cybersecurity response protocol across all critical infrastructure sectors in December 2016. Further, NCIRP states that public and private sector entities should consider creating an operational cyber incident response plan to further organize and coordinate their efforts in response to cyber incidents. Therefore, TSA could potentially provide such an operational cyber incident response plan for the pipeline sector in its plan.

TSA could also better ensure that pipeline operators understand how federal agencies may provide support in response to a cyber incident by periodically reviewing and, as appropriate, revising the plan to include its cyber incident response plan. Representatives of the four pipeline associations we interviewed told us that their membership more clearly understood federal agencies’ roles and responsibilities related to physical incidents than to cybersecurity. For example, for physical incidents the representatives stated that their members clearly understood that they are to first notify local first responders (often through the emergency 911 system) and appropriate state or federal regulators, and are to contact either the National Response Center or TSA’s Transportation Security Operations Center (TSOC), depending on the nature of the incident.

However, they stated that they did not believe all of their members clearly understand that they are to report any actual or suspected cyber incidents that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC. All of the association representatives told us that the process for reporting a cyber incident is less clear because, in part, of the large number of federal agencies with a cybersecurity-related role. One of the representatives also attributed the lack of clarity to the reorganization of NCCIC, and the establishment of CISA. Further, all of the representatives we interviewed indicated that clarifying the cybersecurity roles and responsibilities of DOE, Federal Energy Regulatory Commission (FERC), and TSA would, among other things, improve operators’ ability to appropriately report and respond to a cyber incident.

Federal Incident Management Policies

TSA also has not updated the plan to address changes in federal incident management and response policies that have occurred since the plan was developed in 2010. The plan states that it is to be consistent with the National Response Framework (NRF) and the National Incident Management System (NIMS) incident command system procedures. The NRF was first issued in 2008 and described the roles, responsibilities and coordinating structures for delivering core capabilities during incident response. According to FEMA, it revised the NRF in 2013 and 2016 to reflect lessons learned from real world events and other experiences since the framework was first developed. Likewise, NIMS was developed in 2004 as a comprehensive, national approach to incident management that was to be applicable at all jurisdictional levels and across functional disciplines, such as law enforcement, public health, or public works. According to FEMA, it revised NIMS in 2017 to reflect and incorporate policy updates and lessons learned from exercises and real-world incidents. The revision was also intended to clarify that NIMS applies to all stakeholders with incident management roles, and to enhance guidance on information management processes, data collection plans, social media integration, and the use of geographic information systems. TSA officials acknowledged the benefit of periodically reviewing, and if necessary, revising the plan to reflect FEMA’s revisions to NIMS or the NRF, but had not done so because of competing priorities.

DHS’s Terrorism Alert System

TSA has also not updated the plan to address changes DHS made to its terrorist alert system in 2011. Consistent with the 9/11 Commission Act, the plan describes actions that federal agencies can take at each color- coded level of the Homeland Security Advisory System to ensure the increased security of pipeline infrastructure. For example, under the protect/prevent phase, the plan states that when there is a high risk of a terrorist attack (i.e., red: severe condition) and threat is general and not specific to pipelines, TSA and PHMSA are to coordinate to identify the potential for any related or cascading events that may impact the pipeline sector. However, if there is a specific threat to pipelines, TSA, in collaboration with pipeline operators, is to identify any immediate protective measures that pipeline operators are to implement. TSA is also to ensure pipeline operators have the information necessary to implement these measures, and, if necessary, to issue security directives.

In 2011, DHS replaced the four color-coded alert system of the Homeland Security Advisory System with the National Terrorism Advisory System, which has only two alert levels (elevated threat and imminent threat). TSA issued revised protective measures that pipeline operators are to take under either threat condition in April 2011 and March 2018. However, TSA has not updated the plan to communicate the actions federal agencies can take at either level of the National Terrorism Advisory System to ensure the increased security of pipeline infrastructure.

TSA officials acknowledged that periodically reviewing and, as appropriate, revising the plan would help to clarify federal agencies’ roles and responsibilities for addressing pipeline security. TSA officials reported that they have not updated the plan since 2010 because they faced competing priorities. However, as described earlier, TSA’s incident response plan was developed to provide a comprehensive interagency approach to important activities such as countering risks, coordinating federal agencies’ actions and minimizing the consequences of incidents involving pipeline infrastructure. Further, the plan itself states that it will be updated periodically to address changes in pipeline security threats, technology, and federal laws and policies.

By periodically reviewing and, as appropriate, revising its Pipeline Security and Incident Recovery Protocol Plan, TSA could better ensure that the plan addresses all possible and relevant threats to pipeline systems, such as cybersecurity, and fully incorporates relevant changes, such as those related to incident management and DHS’s terrorism alert system. By doing so, TSA could also provide greater assurance that federal agencies understand the actions they are to take to prevent, respond to, or recover from a physical or cyber incident.

Conclusions

TSA and PHMSA share responsibility for safeguarding the nation’s pipeline systems from catastrophic events. While the 2006 MOU Annex delineates TSA’s and PHMSA’s mutually agreed-upon pipeline security roles and responsibilities, it has not been reviewed since its inception to consider pipeline security developments. By developing and implementing a mutually agreed upon timeline with timeframes for reviewing the annex and as appropriate, updating it, TSA and PHMSA could better ensure that their roles and responsibilities are properly documented and updated in a timely manner to remain current. Furthermore, by revising the MOU Annex to include a provision for periodically reviewing the annex for needed updates, TSA and PHMSA could better ensure the agreement consistently reflects relevant and updated information on their roles and responsibilities.

Similarly, TSA’s Pipeline Security and Incident Recovery Protocol Plan— which defines the roles and responsibilities of federal agencies; tribal, state, and local governments; and the private sector for responding to a pipeline incident—also has not been updated to reflect changes in federal laws or policies since the plan was issued in 2010. By periodically reviewing and, when appropriate, updating its Pipeline Security and Incident Recovery Protocol Plan, TSA could better ensure that the plan addresses and fully incorporates changes relevant to cybersecurity, incident management and DHS’s terrorism alert system, among others. By doing so, TSA could also better ensure that federal agencies’ actions are well coordinated in response to a pipeline-related physical or cyber incident, and that pipeline stakeholders understand federal agencies’ roles and responsibilities in preparing for, responding to, or supporting pipeline operators to restore service after a pipeline-related physical or cyber incident.

Recommendations for Executive Action

We are making a total of five recommendations including three to TSA and two to PHMSA:

The TSA Administrator should work with the PHMSA Administrator to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex. (Recommendation 1)

The PHMSA Administrator should work with the TSA Administrator to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating, the 2006 MOU Annex. (Recommendation 2)

The TSA Administrator, in consultation with the PHMSA Administrator should revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex.(Recommendation 3)

The PHMSA Administrator, in consultation with the TSA Administrator should revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex.(Recommendation 4)

The TSA Administrator should periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes in pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation’s pipeline systems. (Recommendation 5)

Agency Comments and Our Evaluation

We provided a draft of this report to DHS and DOT. DHS and DOT provided written comments which are reproduced in appendices III and IV respectively. We also provided draft excerpts of this product to the American Petroleum Institute (API), the American Gas Association, the Interstate Natural Gas Association of America, and the American Public Gas Association. For those who provided technical comments, we incorporated them as appropriate.

With regard to our first recommendation, that TSA work with the PHMSA to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex, DHS stated that TSA will work with PHMSA to develop and implement a timeline with milestone dates for reviewing and updating, as appropriate, the 2006 MOU Annex. DHS estimated that this effort would be completed by August 31, 2019. This action, if fully implemented, should address the intent of this recommendation.

With regard to our second recommendation, that PHMSA work with TSA to develop and implement a timeline with milestone dates for reviewing and, as appropriate, updating the 2006 MOU Annex, DOT concurred and stated it would provide a detailed response within 180 days of the issuance of this report.

With regard to our third recommendation, that TSA, in consultation with PHMSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex, DHS stated that TSA will, in consultation with PHMSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex. DHS estimated that this effort would be completed by March 31, 2020. This action, if fully implemented, should address the intent of this recommendation.

With regard to our fourth recommendation, that PHMSA, in consultation with TSA, revise the 2006 MOU Annex to include a provision requiring periodic reviews of, and as appropriate, corresponding updates to the Annex, DOT concurred and stated it would provide a detailed response within 180 days of the issuance of this report.

With regard to our fifth recommendation, that TSA periodically review, and as appropriate, update the 2010 Pipeline Security and Incident Recovery Protocol Plan to ensure the plan reflects relevant changes to pipeline security threats, technology, federal law and policy, and any other factors relevant to the security of the nation’s pipeline systems, DHS concurred and estimated that TSA will complete its first review by December 31, 2019. DHS further stated that it will establish a timeline for updating the plan should the review determine that an update is necessary. This action, if fully implemented, should address the intent of this recommendation.

We are sending copies of this report to the appropriate congressional committees; the Secretary of Homeland Security, Secretary of Transportation; and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact William Russell at (202) 512-8777 or russellw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix V.

Appendix I: 2006 Memorandum of Understanding (MOU) Program Areas and Accompanying Text

The Transportation Security Administration (TSA) and Pipeline and Hazardous Materials Safety Administration (PHMSA),”the parties”, recognize that the following program areas are important to the development and deployment of an enhanced security strategy for the transportation of hazardous materials by all modes, including pipeline.

Appendix II: Summary of Key Federal Agencies’ and Pipeline Operator’s Roles and Responsibilities

This appendix summarizes the roles and responsibilities of key federal agencies as well as the actions that they may take in response to an incident as detailed in Transportation Security Administration’s (TSA) 2010 Pipeline Security and Incident Recovery Protocol Plan. A summary of pipeline stakeholder’s roles, responsibilities, and examples of actions that may be taken during each incident response phase is presented below.

Prevention/Protection. During the prevention/protection phase, pipeline operators are to use TSA’s pipeline security guidance and the Pipeline and Hazardous Materials Safety Administration’s (PHMSA) safety regulations as the framework to prepare and prevent against an incident. TSA is responsible for monitoring pipeline owners and operators’ implementation its security guidelines, and PHMSA is responsible for enforcing its safety regulations. The plan also states that during this phase TSA is to assume a primary role for ensuring federal agencies’ actions are coordinated through protective security advisors (PSAs). In addition, the Federal Bureau of Investigation (FBI) is responsible for assessing the credibility of a known threat, preparing and implementing a preliminary investigative plan, and, if necessary, disseminating public safety notifications. The Department of Energy (DOE) is responsible for assessing and monitoring pipeline systems for supply shortages.

The prevention/protection section of the plan also describes how agencies are to share and assess threat information. For example, the plan states that TSA, PHMSA, or any federal agency that receives threat information regardless of the source, must immediately notify the FBI. It also states that if the FBI receives intelligence about a pipeline threat, it is to share this information with TSA. TSA is then to notify the pipeline operator and, if necessary, provide recommendations for additional protective measures.

Finally, the prevention/protection section of the plan defines actions various agencies can implement during a heightened security threat level to increase protection from a potential attack. For example, when there is a high risk of a terrorist attack (i.e., red: severe condition) and threat is general and not specific to pipelines, TSA and PHMSA are to coordinate to identify the potential for any related or cascading events that may impact the pipeline sector. If there is a specific threat to pipelines, TSA is, in collaboration with pipeline operators, to identify any immediate protective measures that ought to be taken by pipeline operators, and ensure pipeline operators have the information necessary to implement them, and, if necessary issue security directives.

Response. According to the plan, pipeline owners or operators are to notify local first responders and state regulators through the emergency 911 system. After the pipeline operator has notified local government, they are to contact the National Response Center (NRC) if the incident results in an unintentional release or causes significant damage. As we previously reported, pipeline operators are also requested to report any physical security incident that is indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt to TSA’s Transportation Security Operations Center (TSOC). Once TSA has been notified of an incident by a pipeline operator, its Pipeline Security Branch is to monitor the incident, notify relevant federal agencies, and, if deemed appropriate, activate the Interagency Threat Coordination Committee (ITCC). PHMSA may also deploy on-scene pipeline inspectors and investigators which are to among other things, coordinate federal agencies’ activities with the affected pipeline operator and state pipeline safety agency, provide subject matter expertise to the incident command, and direct safe restoration of pipeline facilities and services.

The plan also states that, during the response phase, responsibility for investigating the incident falls to NTSB or the FBI depending on whether the incident is determined to be the result of criminal activity. The FBI is solely responsible for investigating any pipeline security incident that appears to be an intentional criminal act. For example, if the incident were suspected to be the result of terrorist attack, the National Joint-Terrorism Task Force would conduct an investigation of the attack, and if appropriate, with assistance from other FBI assets. If, however, the incident resulted in fatalities, substantial property damage, or significant injury to the environment, NTSB would have responsibility for investigating the incident, and may issue safety recommendations to help prevent future accidents.

Recovery. When response activities are complete, PHMSA is to have primary responsibility for overseeing pipeline operators’ safe restoration of service with TSA and other federal agencies serving primarily in support roles. PHMSA, for example, is to work with the owner/operator to facilitate restoration of service by, among other things, providing technical oversight, advice, and guidance to owner/operators; coordinating recovery activities with state pipeline safety agency, and evaluate whether to a special permit is necessary to facilitate an expedited restoration of services. Meanwhile, DOE is to continue to assess the impacts of an incident on energy infrastructure, and advise federal, state, tribal, and local authorities on priorities for energy restoration, assistance, and supply.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: Comments from the Department of Transportation

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Ben Atwater, Assistant Director and Michael C. Lenington, Analyst-in-Charge, managed this assignment. Nanette Barton, Eric Hauswirth, Susan Hsu, and Thomas Lombardi also made significant contributions to this report.