Critical Infrastructure Protection: Actions Needed to Address Significant Weaknesses in TSA's Pipeline Security Program Management
Released: 2018-12-19T00:00:00

Letter

Background

Overview of the U.S. Pipeline System

The national pipeline system consists of more than 2.7 million miles of networked pipelines transporting oil, natural gas, and other hazardous liquids. Hazardous liquid and natural gas pipelines—primarily buried underground in the continental United States—run under remote and open terrain, as well as densely populated areas. These pipelines are of three main types:

Hazardous liquid: About 216,000 miles of hazardous liquid pipeline transport crude oil, diesel fuel, gasoline, jet fuel, anhydrous ammonia, and carbon dioxide.

Natural gas transmission and storage: About 319,000 miles of pipeline—mostly interstate—transport natural gas from sources to communities.

Natural gas distribution: About 2.2 million miles of pipeline—mostly intrastate—transport natural gas from transmission sites to consumers.

Figure 1 depicts the network of hazardous liquid and natural gas transmission pipelines in the United States.

More than 3,000 pipeline companies operate the nation’s pipeline systems, which can traverse multiple states and the U.S. borders with Canada and Mexico. Many pipeline systems are comprised of the pipelines themselves, as well as a variety of facilities, such as storage tanks, compressor stations, and control centers. Most pipeline systems are monitored and moderated through automated ICS or Supervisory Control and Data Acquisition (SCADA) systems using remote sensors, signals, and preprogramed parameters to activate and deactivate valves and pumps to maintain flows within tolerances.

Federal agencies and pipeline operators determine the criticality of pipeline systems and their facilities based on their importance to the nation’s energy infrastructure; service to installations critical to national defense; or, if attacked, have the potential to cause mass casualties and significant impact on public drinking water affecting major population centers. Accordingly, those determined to be critical merit increased attention to security. However, as we previously reported, the inherent design and operation of U.S. pipeline systems may reduce some potential impacts of lost service. The pipeline sector is generally considered to be resilient and versatile. Historically, pipeline operators have been able to quickly respond to the adverse consequences of an incident—whether it is damage from a major hurricane or a backhoe—and quickly restore pipeline service. Pipeline infrastructure also includes redundancies such as parallel pipelines or interconnections that enable operators to reroute material through the network. Figure 2 depicts the U.S. pipeline system, its basic components, examples of vulnerabilities, and the entities to which it supplies energy and raw materials. These entities include utility companies, airports, military sites, and industrial and manufacturing facilities.

Physical and Cyber Threats to Pipeline Systems

According to TSA, pipelines are vulnerable to physical attacks—including the use of firearms or explosives—largely due to their stationary nature, the volatility of transported products, and the dispersed nature of pipeline networks spanning urban and outlying areas. The nature of the transported commodity and the potential effect of an attack on national security, commerce, and public health make some pipelines and their assets more attractive targets for attack. Oil and gas pipelines have been and continue to be targeted by terrorists and other malicious groups globally. Terrorists have also targeted U.S. pipelines, but have not succeeded in attacking them. Further, environmental activists and lone actors seeking to halt the construction of new pipelines through sabotage have recently emerged as a new threat to pipelines. For example, in March 2017, activists used blowtorches to cut holes in empty portions of the Dakota Access Pipeline in two states. In February 2017, local law enforcement officers fatally shot a man who used an assault rifle to damage the Sabal Trail Pipeline, a natural gas pipeline under construction in Florida.

The sophisticated computer systems that pipeline operations rely on are also vulnerable to various cyber threats. According to DOE, the frequency, scale, and sophistication of cyber threats have increased, and attacks have become easier to launch. NCCIC reported that the energy sector, which includes pipelines, experienced more cyber incidents than any sector from 2013 to 2015, accounting for 35 percent of the 796 incidents reported by all critical infrastructure sectors. In 2016, NCCIC reported that the energy sector was the third most frequently attacked sector. Further, according to DOE, the cost of preventing and responding to cyber incidents in the energy sector is straining the ability of companies to adequately protect their critical cyber systems. For example, a 2015 study by the Ponemon Institute estimated the annualized cost of cyber crime for an average energy company to be about $28 million.

Ineffective protection of cyber assets from these threats can increase the likelihood of security incidents and cyber attacks that disrupt critical operations; lead to inappropriate access to and disclosure, modification, or destruction of sensitive information; and threaten national security, economic well-being, and public health and safety. Unintentional or nonadversarial threat sources may include failures in equipment or software due to aging, resource depletion, and errors made by end users. They also include natural disasters and failures of critical infrastructure on which the organization depends, but that are outside of the control of the organization.

Intentional or adversarial threats may include corrupt employees, criminal groups, terrorists, and nations that seek to leverage the organization’s dependence on cyber resources (i.e., information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies). These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain or seeking an economic, political, or military advantage.

Cyber threat adversaries make use of various techniques, tactics, practices, and exploits to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. For example, an attacker could infiltrate a pipeline’s operational systems via the internet or other communication pathways to potentially disrupt its service and cause spills, releases, explosions, or fires. Moreover, ICS, which were once largely isolated from the Internet and the company’s information technology systems, are increasingly connected in modern energy systems, allowing cyber attacks to originate in business systems and migrate to operational systems. For example, malicious nation-state actors used spear-phishing and other similar approaches in 2018 against energy sector organizations to gain access to their business systems, conduct reconnaissance, and collect information about their ICS. Similarly, in April 2012, the Industrial Control Systems Cyber Emergency Response Team reported that an unidentified cyber attacker had conducted a series of cyber intrusions into U.S. natural gas pipeline systems beginning in December 2011.

Key Critical Infrastructure Protection Guidance and Presidential Directives

Federal policy and public-private plans establish roles and responsibilities for the protection of critical infrastructure, including pipelines. These include Presidential Policy Directive 21 (PPD-21), the NIPP, and Executive Order 13636. PPD-21, issued in February 2013, reflects an all- hazards approach to protecting critical infrastructure, including natural disasters, terrorism, and cyber incidents. The directive also identifies the 16 critical infrastructure sectors and assigns roles and responsibilities for each critical infrastructure sector among nine designated federal sector-specific agencies.

While PPD-21 identified the critical infrastructure sectors and assigned responsibility for each sector’s sector-specific agency, the NIPP outlines critical infrastructure stakeholder roles and responsibilities regarding critical security and resilience. It describes a voluntary partnership model as the primary means of coordinating government and private sector efforts to protect critical infrastructure. As part of the partnership structure, the designated sector-specific agencies serve as the lead coordinators for security programs of their respective sector. As sector-specific agencies, federal departments or agencies lead, facilitate, or support the security and resilience programs and associated activities of their designated critical infrastructure sector. For example, DHS and DOT are both designated as sector-specific agencies for the transportation systems sector, which includes pipelines. Each sector also has a government coordinating council, consisting of representatives from various levels of government, and many have a sector coordinating council (SCC) consisting of owner-operators of these critical assets or members of their respective trade associations. For example, the Transportation Government Coordinating Council has been established, and the Pipeline Modal SCC has been established to represent pipeline operators.

The NIPP also outlines a risk management framework for critical infrastructure protection. As shown in Figure 3, the NIPP uses a risk management framework as a planning methodology intended to inform how decision makers take actions to manage risk. The risk management framework calls for public and private critical infrastructure partners to conduct risk assessments to understand the most likely and severe incidents that could affect their operations and communities, and use this information to support planning and resource allocation.

According to DHS, the risk management framework is influenced by the nature and magnitude of a threat, the vulnerabilities to that threat, and the consequences that could result, as shown in Figure 4.

Federal policy has encouraged voluntary information-sharing mechanisms between the federal government and critical infrastructure owners and operators. For example, Information Sharing and Analysis Centers (ISAC) are formed by critical infrastructure owners and operators to gather, analyze, appropriately sanitize, and disseminate intelligence and information related to critical infrastructure. They typically collect, analyze and disseminate actionable threat information to their members and provide members with tools to mitigate risks and enhance resiliency. ISACs in which pipeline operators may participate have been formed including the Oil and Natural Gas ISAC, Downstream Natural Gas ISAC, and Electricity ISAC.

Finally, in February 2013, the president issued Executive Order 13636, Improving Critical Infrastructure Cybersecurity, which cited repeated cyber intrusions into critical infrastructure as demonstrating the need for improved cybersecurity. Executive Order 13636 outlined actions for improving critical infrastructure cybersecurity, including direction for the National Institute of Standards and Technology (NIST) to lead the development of a voluntary risk-based cybersecurity framework that would comprise a set of industry standards and best practices to help organizations manage cybersecurity risks. NIST issued the framework in 2014 and updated it in April 2018. The order also addressed the need to improve cybersecurity information sharing and collaboratively develop risk-based standards and stated that U.S. policy was to increase the volume, timeliness, and quality of cyber threat information shared with private sector entities so that these entities may better protect and defend themselves against cyber threats.

Pipeline Stakeholders’ Security Roles and Responsibilities

Protecting the nation’s pipeline systems is a responsibility shared by both the federal government and private industry. As a result, several federal departments, agencies, and the private sector have significant roles in pipeline physical and cyber-related security. These entities include the following: Transportation Security Administration (TSA). TSA, within DHS, has primary oversight responsibility for the physical security and cybersecurity of transmission and distribution pipeline systems. Within TSA, the Security Policy and Industry Engagement’s Pipeline Security Branch is charged with overseeing its pipeline security program. Pursuant to its authority, TSA’s Pipeline Security Branch first issued its voluntary Pipeline Security Guidelines in 2011, and released revised guidelines in March 2018. In accordance with the 9/11 Commission Act, TSA’s Pipeline Security Branch identifies the top 100 critical pipeline systems in the nation. To do so, it uses system annual throughput, which is based on the amount of hazardous liquid or natural gas product transported through a pipeline in 1 year (i.e., annual throughput). TSA also ranks the relative risk among the top 100 critical pipeline systems, discussed later in the report. Additionally, TSA’s Pipeline Security Branch is responsible for conducting voluntary Corporate Security Reviews (CSR) and Critical Facility Security Reviews (CFSR), which assess the extent to which the 100 most critical pipeline systems are following the intent of TSA’s Pipeline Security Guidelines. See figure 5 below for an overview of the CSR and CFSR processes.

In addition, TSA Intelligence and Analysis is responsible for collecting and analyzing threat information related to the transportation network, and sharing relevant threat information to pipeline stakeholders.

National Cybersecurity and Communications Integration Center (NCCIC). Within DHS, NCCIC assists critical infrastructure owners in addressing cyber incidents and attacks, including those targeting industrial control systems. The NCCIC’s mission is to reduce the likelihood and severity of incidents that may significantly compromise the security and resilience of the nation’s critical information technology and communications networks. NCCIC’s role is to serve as the federal civilian interface for sharing information related to cybersecurity risks, incidents, analysis, and warnings with federal and nonfederal entities, and to provide shared situational awareness to enable real-time actions to address cybersecurity risks and incidents to federal and nonfederal entities.

Pipeline and Hazardous Materials Safety Administration (PHMSA). PHMSA, within DOT, is responsible for regulating the safety of hazardous materials transportation and the safety of pipeline systems, some aspects of which can be related to pipeline security. In 2004, PHMSA and TSA entered into a memorandum of understanding regarding their respective roles in all modes of transportation. In 2006, they signed an annex to the memorandum of understanding that further delineates lines of authority and responsibility between TSA and PHMSA on pipeline and hazardous materials transportation security. The annex identifies TSA as the lead federal entity for transportation security, including hazardous materials and pipeline security, and PHMSA as responsible for administering a national program of safety in natural gas and hazardous liquid pipeline transportation, including identifying pipeline safety concerns and developing uniform safety standards.

Department of Energy (DOE). DOE is responsible for protecting electric power, oil, and natural gas delivery infrastructure and, in December 2015, was identified in statute as the sector-specific agency for cybersecurity for the energy sector. The Office of Cybersecurity, Energy Security, and Emergency Response is the lead for DOE’s cybersecurity efforts. In addition, DOE operates the National SCADA Test Bed Program, a partnership with Idaho National Laboratory, Sandia National Laboratories, and other national laboratories which addresses control system security challenges in the energy sector. Among its key functions, the program performs control systems testing, research, and development; control systems requirements development; and industry outreach.

Federal Energy Regulatory Commission (FERC). FERC regulates the U.S. bulk electric power system, which is increasingly powered by natural gas pipeline systems. FERC has regulatory authority over interstate natural gas pipelines under the Natural Gas Act. However, its role is limited to natural gas pipeline siting and rate regulation. The North American Electric Reliability Corporation is the federally designated U.S. Electric Reliability Organization, and is overseen by FERC. The North American Electric Reliability Corporation, with approval from FERC, has developed mandatory critical infrastructure protection standards for protecting electric utility–critical and cyber-critical assets.

Private sector. Although TSA has primary federal responsibility for overseeing interstate pipeline security, private sector pipeline operators are responsible for implementing asset-specific protective security measures. As we previously reported, operators have increased their attention on security by incorporating security practices and programs into their overall business operations. Pipeline operators’ interests and concerns are primarily represented by five major trade associations with ties to the pipeline industry—the Interstate Natural Gas Association of America (INGAA), American Gas Association (AGA), American Public Gas Association, American Petroleum Institute (API), and Association of Oil Pipe Lines. According to TSA officials, pipeline operators, and association representatives, these associations have worked closely with the federal government on a variety of pipeline security-related issues, including collaborating on TSA’s voluntary standards and information sharing.

Federal and Nonfederal Pipeline Stakeholders Exchange Risk- Related Security Information

All of the pipeline operators and pipeline association representatives we interviewed reported receiving security information from federal and nonfederal entities. Pipeline operators also reported providing security- related information to federal agencies, including TSA, as incidents occur. Multiple federal entities exchange alerts of physical and cybersecurity incidents and other risk-related information with critical infrastructure partners, including pipeline operators. For example, DHS components including TSA’s Intelligence and Analysis and NCCIC share security- related information on physical and cyber threats and incidents with sector stakeholders. Specifically, Intelligence and Analysis provides quarterly intelligence briefings to pipeline operators. NCCIC also issues indicator bulletins, which can contain information related to cyber threat indicators, defensive measures, and cybersecurity risks and incidents.

In addition, TSA and other federal entities have coordinated to address specific pipeline-related security incidents. For example, TSA officials coordinated with DOT, DOE, the Department of Justice, and FERC through the Oil and Natural Gas subsector SCC to address ongoing incidents of vandalism and sabotage of critical pipeline assets by environmental activists in 2016. In July 2017, according to DOT officials, PHMSA and TSA collaborated on a web-based portal to facilitate sharing sensitive but unclassified incident information among federal agencies with pipeline-related responsibilities. See table 1 for the key federal information sharing entities and programs that exchange security-related or incident information with critical infrastructure stakeholders, including the pipeline sector.

Pipeline operators also share security-related information with TSA and the NCCIC. In its Pipeline Security Guidelines, TSA requests that pipeline operators report by telephone or email to its Transportation Security Operations Center (TSOC) any physical security incidents that are indicative of a deliberate attempt to disrupt pipeline operations or activities that could be considered precursors to such an attempt. TSA’s Pipeline Security Guidelines also request that operators report any actual or suspected cyber attacks that could impact pipeline industrial control systems or other information technology-based systems to the NCCIC. According to the TSOC’s operating procedures, if a reported incident meets certain criteria, such as the incident was intended to or resulted in damage or requires a general evacuation of a facility, the TSOC watch officer is then to contact Office of Security and Industry Engagement officials. According to TSA officials, the TSOC does not conduct investigations of the specific security incidents that pipeline operators report. However, TSOC staff do analyze the incident information they receive for national trends and common threats. TSA officials stated that they share their observations with pipeline operators and other critical infrastructure asset owners during monthly and quarterly conference calls that TSA holds with pipeline operators.

All the pipeline operators and association representatives we interviewed identified other nonfederal information sharing entities, including ISACs, fusion centers, industry associations, and SCCs, which provide forums for exchanging information about physical and cyber incidents throughout the pipeline sector. See table 2 for nonfederal information sharing entities identified as available to pipeline operators.

Operators and TSA officials reported that the current backlog in granting security clearances for some key pipeline operator employees was a significant factor affecting information sharing between TSA and pipeline operators. TSA officials acknowledged that some pipeline operators have had difficulty obtaining security clearances for key employees due to ongoing backlogs in processing requests by the Office of Personnel Management National Background Investigation Bureau, and that TSA’s ability to share timely information with operators whose staff do not have a clearance may be hindered. Three of the 10 pipeline operators we interviewed identified receiving timely classified security information as a specific challenge due, in part, to difficulties staff have had obtaining security clearances. Further, 7 of the 10 pipeline operators that we interviewed reported experiencing delays in obtaining a security clearance or were aware of others who had experienced this issue. However, according to three operators we interviewed, TSA was helpful in facilitating approval of security clearances for the operators’ personnel to access classified information when necessary.

This security clearance challenge is not faced by pipeline operators alone. In January 2018, we designated the backlog of investigations for the clearance process and the government-wide personnel security clearance process as a high-risk area. We will continue to monitor agencies’ progress in reducing the backlog and improving the security clearance process.

Pipeline Operators Use a Range of Guidelines and Standards to Address Risks, but TSA’s Guidelines Lack Clear Definitions and a Process for Updating Them

Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks, and all of them reported implementing TSA’s voluntary Pipeline Security Guidelines that were applicable to their operations. TSA revised and issued its Pipeline Security Guidelines in March 2018, but the revised guidelines lack a defined process to consider updates to supporting guidance such as to the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework). Furthermore, TSA has not clearly defined the terms within the criteria that pipeline operators are to use to determine the criticality of their facilities.

Pipeline Operators Use a Range of Guidelines and Standards to Address Security

Pipeline operators that we interviewed reported using a range of guidelines and standards to address their physical and cybersecurity risks. For example, all 10 of the pipeline operators we interviewed stated they had implemented the voluntary 2011 TSA Pipeline Security Guidelines the operators determined to be applicable to their operations. The guidelines provide TSA’s recommendations for pipeline industry security practices such as establishing a corporate security program and identifying critical facilities among others (see sidebar). Five of the 10 pipeline operators we interviewed characterized the guidelines as generally or somewhat effective in helping to secure their operations, 1 was neutral on their effectiveness, and 4 did not provide an assessment of the guidelines’ effectiveness. However, one operator pointed out that they had not adopted the guidelines’ recommended interval of 36 months or less for conducting security vulnerability assessments due to staffing limitations. Also, another pipeline operator noted that they were working to implement the guidelines in the operations of a newly acquired asset that they determined was not using the guidelines in the same manner as their company.

All of the pipeline operators we interviewed reported using other guidelines or standards to address pipeline systems’ security risks. For example, pipeline operators reported using and industry association representatives reported that their members use INGAA’s Control Systems Cyber Security Guidelines for the Natural Gas Pipeline Industry, API’s Pipeline SCADA Security standard, and the NIST Cybersecurity Framework as sources of cybersecurity standards, guidelines, and practices that may be scaled and applied to address a pipeline operator’s cybersecurity risks.

Further, pipeline operators are required to adhere to regulations related to pipeline safety and, depending upon their assets, operations, and location, may be required to adhere to regulations for electrical utilities, chemical storage facilities, and locations near waterways. For example, all pipeline operators must adhere to DOT’s PHMSA safety regulations. In addition, pipeline operators whose systems include chemical facilities may be required to comply with DHS’s Chemical Facility Anti-Terrorism Standards (CFATS). Pipeline operators whose systems include a terminal located on a U.S. port may be required to comply with Maritime Transportation Security Act regulations. For a listing of federal and industry guidelines identified as applicable to security by the pipeline operators, see appendix I.

TSA Does Not Have a Documented Process for Updating Its Pipeline Security Guidelines to Reflect Revisions to Supporting Standards

TSA’s Pipeline Security Branch issued its revised Pipeline Security Guidelines in March 2018, but TSA has not established a documented process to ensure that revisions occur and fully capture updates to supporting standards and guidance. The guidelines were revised to, among other things, reflect the dynamic threat environment and to incorporate cybersecurity principles and practices from the NIST Cybersecurity Framework, which were initially issued in February 2014. To revise the guidelines and incorporate feedback, according to Pipeline Security Branch officials, they incorporated outcomes from pipeline modal threat assessments and best practices from security reviews, and collaborated with pipeline sector stakeholders—including industry associations and other federal agencies with a role in pipeline security. Officials from the industry associations we interviewed confirmed that they provided input to the revised pipeline guidelines, including meeting with and consolidating comments from member pipeline operators. See figure 6 for a timeline of events pertinent to federal pipeline security guidelines.

TSA’s Pipeline Security Smart Practice Observations for pipeline operators states that security plans should have a documented process to include security plan reviews and updates on a periodic and an as- needed basis. Standards for Internal Control in the Federal Government states that periodic review of policies, procedures, and related control activities should occur to determine their continued relevance and effectiveness in achieving identified objectives or addressing related risks. The NIPP and NIST also emphasize the need to provide updates on incident response guidance and security procedures, respectively. Moreover, other pipeline industry guidance cited by TSA’s guidelines also has a prescribed interval for review and revision. For example, API reviews its standards at least every 5 years.

However, TSA has not instituted a documented process to consider the need to update the Pipeline Security Guidelines on a regular basis. Pipeline Security Branch officials acknowledged the value of having a defined process for reviewing and, if necessary, revising TSA’s Pipeline Security Guidelines at regular defined intervals to ensure it includes, among other things, newly identified best practices and updated industry guidance that are relevant to pipeline operators, such as the elements of the latest version of NIST’s Cybersecurity Framework. For example, TSA’s revisions to its guidelines incorporated some, but not all of the elements of the NIST Cybersecurity Framework version 1. Specifically, to improve incident response, the NIST framework recommends implementing an incident response analysis and feedback function to a security program. However, TSA’s Pipeline Security Guidelines do not include similar steps for pipelines operators to include in their pipeline security programs. Further, because NIST released version 1.1 of the Cybersecurity Framework in April 2018, the guidelines that TSA released in March 2018 do not incorporate cybersecurity elements that NIST added to the latest Cybersecurity Framework such as the Supply Chain Risk Management category.

Pipeline Security Branch officials said that they have not instituted a review process on a regular basis because they intended to review and revise TSA’s guidelines on an as-needed basis in response to updated supporting guidance, but could provide no timeline for doing so. Without a documented process defining how frequently Pipeline Security Branch staff are to review and revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system.

Pipeline Security Guidelines Lack Clear Definitions to Ensure Pipeline Operators Consistently Apply TSA’s Criteria for Identifying Critical Facilities

Under TSA’s Pipeline Security Guidelines, pipeline operators are to self- identify the critical facilities within their system and report their critical facilities to TSA. TSA’s Pipeline Security Branch conducts CFSRs at the critical facilities that pipeline operators have identified.

However, our analysis of TSA’s data found that at least 34 of the top 100 critical pipeline systems deemed highest risk indicated that they had no critical facilities. Accordingly, TSA would not conduct a CFSR at any of these systems’ facilities because their operators identified none of them as critical.

The fact that pipeline operators of about one third of the highest risk systems identified no critical facilities may be due, in part, to the Pipeline Security Branch not clearly defining the criteria outlined in the Pipeline Security Guidelines that pipeline operators are to use to determine the criticality of their facilities. Three of the 10 operators we interviewed stated that some companies reported to TSA that they had no critical facilities, and may possibly be taking advantage of the guidelines’ lack of clarity. Accordingly, operators that report no critical facilities would avoid TSA’s reviews of their facilities. service or deliverability resulting in a state or local government's inability to provide essential public services and emergency response for an extended period of time;

Significantly damage or destroy national intended use of major rivers, lakes, or waterways (e.g., public drinking water for large populations or disruption of major commerce or public transportation routes); service or deliverability to a significant number of customers or individuals for an extended period of time; operations for an extended period of time (i.e., business critical facilities).

Our review of the eight criteria included in TSA’s Pipeline Security Guidelines (see sidebar) found that no additional examples or clarification are provided to help operators determine criticality. Although we previously noted that 5 of the 10 operators we interviewed generally found TSA’s Guidelines as a whole helpful in addressing pipeline security, more than half of the operators we interviewed identified TSA’s criticality criteria as a specific area for improvement. Specifically, 3 of the 10 pipeline operators that we interviewed stated that TSA had not clearly defined certain terms within the criteria, and 3 additional operators of the 10 reported that additional consultation with TSA was necessary to appropriately apply the criteria and determine their facilities’ criticality. For example, 2 operators told us that individual operators may interpret TSA’s criterion, “cause mass casualties or significant health effect,” differently. One of these operators that we interviewed stated that this criterion could be interpreted either as a specific number of people affected or a sufficient volume to overwhelm a local health department, which could vary depending on the locality. Another operator reported that because TSA’s criteria were not clear, they created their own criteria which helped the operator identify two additional critical facilities.

Pipeline Security Branch officials acknowledged there are companies that report having no critical facilities in their pipeline systems. According to Pipeline Security Branch officials, pipeline operators are in the best position to determine which of their facilities are critical, and the companies that have determined that their pipeline systems have no critical facilities also have reported sufficient redundancies to make none of their facilities critical to the continuity of their operations. According to these officials, they have had extensive discussions with pipeline company officials to assess the validity of their criticality determinations, and have closely questioned companies to ensure they have properly applied TSA’s criteria.

However, according to TSA’s Pipeline Security Guidelines, operators should use a consistent set of criteria for determining the criticality of their facilities. In addition, Standards for Internal Control in the Federal Government states that management should define objectives clearly to enable the identification of risks. To achieve this, management generally defines objectives in specific and measurable terms and ensures the terms are fully and clearly set forth so they can be easily understood.

Pipeline Security Branch officials acknowledged that the criticality definitions in the Pipeline Security Guidelines could be clarified to be more specific. Additionally, an industry association representative reported that the association, in consultation with TSA, has been developing supplementary guidance for its members to clarify certain terms in TSA’s critical facility criteria. As of October 2018 this guidance is still under review at the association and has not been made available to the association’s members. Pipeline Security Branch officials confirmed they worked with the industry association on its supplementary guidance, but also acknowledged that the supplementary guidance may only be distributed to the association’s membership.

Without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying its guidance uniformly. Further, because TSA selects the pipeline facilities on which to conduct CFSRs based on operators’ determinations, TSA cannot fully ensure that all of the critical facilities across the pipeline sector have been identified using the same criteria, or that their vulnerabilities have been identified and addressed.

TSA Assesses Pipeline Risk and Conducts Security Reviews, but Limited Workforce Planning and Shortfalls in Assessing Risk Present Challenges

TSA’s Intelligence and Analysis identifies security risks to pipeline systems through various assessments. Additionally, TSA’s Pipeline Security Branch conducts security reviews to assess pipeline operators’ implementation of TSA’s Pipeline Security Guidelines, but gaps in staffing and lack of a workforce plan may affect its ability to carry out effective reviews. The Pipeline Security Branch also developed a pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems and to prioritize its security reviews of pipeline companies, but shortfalls in its calculations of threat, vulnerability, and consequence may limit its ability to accurately identify pipeline systems with the highest risk. Finally, the pipeline risk assessment has not been peer reviewed to validate the assessment’s data and methodology, which we previously reported as a best practice in risk management.

TSA Conducts Assessments of Pipeline Security Risks

TSA’s Intelligence and Analysis produces assessments related to pipeline security risks, including Pipeline Modal and Cyber Modal Threat Assessments and the Transportation Sector Security Risk Assessment. The Pipeline and Cyber Modal Threat Assessments are issued on a semiannual basis; TSA Intelligence and Analysis may also issue additional situation-based products on emerging threats. The Pipeline Modal and Cyber Modal Threat Assessments evaluate, respectively, physical and cyber threats to pipelines. The pipeline modal threat assessment evaluates terrorist threats to hazardous liquid and natural gas pipelines, and the cyber modal threat assessment evaluates cyber threats to transportation, including pipelines. Both assessments specifically analyze the primary threat actors, their capabilities, and activities—including attacks occurring internationally—as well as other characteristics of threat.

The Transportation Sector Security Risk Assessment assesses threat, vulnerability, and consequence for various attack scenarios across the five transportation modes for which TSA is responsible. The scenarios define a type of threat actor—including homegrown violent extremists and transnational extremists, such as al Qaeda and its affiliates—a target, and an attack mode. For example, a scenario might assess the risk of attacks using varying sizes of improvised explosive devices on pipeline system assets. As part of the assessment process, TSA engages with subject matter experts from TSA and industry stakeholder representatives to compile vulnerabilities for each mode, and TSA analyzes both direct and indirect consequences of the various attack scenarios. According to Pipeline Security Branch officials, the assessments produced by TSA’s Intelligence and Analysis provide key information to inform the pipeline security program’s efforts.

TSA Conducts Pipeline Security Reviews to Assess Implementation of Pipeline Guidelines, but Does Not Have a Strategic Workforce Plan to Address Staffing Challenges

According to TSA officials, TSA conducts pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs)—to assess pipeline vulnerabilities and industry implementation of TSA’s Pipeline Security Guidelines. However, as shown by Figure 7 below, the number of CSRs and CFSRs completed by TSA has varied during the last five fiscal years, ranging from zero CSRs conducted in fiscal year 2014 to 23 CSRs conducted in fiscal year 2018, as of July 31, 2018.

TSA officials reported that staffing limitations have prevented TSA from conducting more reviews. As shown in table 3, TSA Pipeline Security Branch staffing levels (excluding contractor support) have varied significantly over the past 9 years ranging from 14 full-time equivalents (FTEs) in fiscal years 2012 and 2013 to one FTE in fiscal year 2014. They stated that, while contractor support has assisted with conducting CFSRs, there were no contractor personnel providing CSR support from fiscal years 2010 through 2017, but that has now increased to two personnel in fiscal year 2018.

TSA prioritizes reviewing and collecting information on the nation’s top 100 critical pipeline systems. According to TSA officials, they would need to conduct 46 CSRs in order to review the top 100 critical pipeline systems. In July 2018, TSA officials stated that TSA’s current target was to assess each pipeline company every 2 to 3 years; this would equate to about 15 to 23 CSRs per year. TSA officials stated that they expect to complete 20 CSRs and 60 CFSRs per fiscal year with Pipeline Security Branch employees and contract support, and have completed 23 CSRs through July 2018 for fiscal year 2018.

Given the ever-increasing cybersecurity risks to pipeline systems, ensuring that the Pipeline Security Branch has the required cybersecurity skills to effectively evaluate pipeline systems’ cybersecurity is essential. Pipeline operators we interviewed emphasized the importance of cybersecurity skills among TSA staff. Specifically, 6 of the 10 pipeline operators and 3 of the 5 industry representatives we interviewed reported that the level of cybersecurity expertise among TSA staff and contractors may challenge the Pipeline Security Branch’s ability to fully assess the cybersecurity portions of its security reviews. TSA officials stated that Security Policy and Industry Engagement staff are working with DHS’s National Protection and Programs Directorate to help address cyber- related needs, including identifying specific cybersecurity skills and competencies required for the pipeline security program. The officials were uncertain, however, whether TSA would use contractor support or support from the National Protection and Programs Directorate to provide identified skills and competencies. TSA officials also stated that Security Policy and Industry Engagement staff work with TSA’s human resource professionals to identify critical skills and competencies needed for Pipeline Security Branch personnel, and helps its workforce maintain professional expertise by providing training and education for any identified skill or competency gaps.

Our previous work has identified principles that a strategic workforce planning process should follow including developing strategies tailored to address gaps in number, deployment, and alignment of human capital approaches for enabling and sustaining the contributions of all critical skills and competencies. Workforce planning efforts, linked to an agency’s strategic goals and objectives, can enable it to remain aware of and be prepared for its needs, including the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed for it to pursue its mission. Agencies should consider how hiring, training, staff development, performance management, and other human capital strategies can be aligned to eliminate gaps and improve the long-term contribution of skills and competencies identified as important for mission success.

TSA has not established a workforce plan for its Security Policy and Industry Engagement or its Pipeline Security Branch that identifies staffing needs and skill sets such as the required level of cybersecurity expertise among TSA staff and contractors. When asked for TSA strategic workforce planning documents used to inform staffing allocations related to the pipeline security program, TSA officials acknowledged they do not have a strategic workforce plan. Rather, according to these officials, TSA determines agency-level staffing allocations through the Planning, Programming, Budgeting and Execution process, which is used to decide policy, strategy, and the development of personnel and capabilities to accomplish anticipated missions. According to TSA officials, when they use this process they look at existing resources and then set priorities based on the TSA Administrator’s needs. However, a strategic workforce plan allows an agency to identify and prepare for its needs, such as the size of its workforce, its deployment across the organization, and the knowledge, skills, and abilities needed to pursue its mission. TSA officials stated that the agency has a detailed allocation plan for strategically aligning resources to screen passengers at TSA-regulated airports, but not for the entire agency.

By establishing a strategic workforce plan, TSA can help ensure it has identified the knowledge, skills, and abilities that the future workforce of TSA’s Pipeline Security Branch may need in order to meet its mission of reducing pipeline systems’ vulnerabilities to physical and cybersecurity risks, especially in a dynamic and evolving threat environment. Further, as greater emphasis is placed on cybersecurity, determining the long- term staffing needs of the Pipeline Security Branch will be essential. Furthermore, a workforce plan could enable TSA to determine the number of personnel it needs to meet its stated goals for conducting CSRs and CFSRs.

TSA Calculates Relative Risk of Pipeline Systems, but Its Ranking Tool Does Not Include Current Data or Align with DHS Priorities to Help Prioritize Security Reviews

After TSA identifies the top 100 critical pipeline systems based on throughput, the Pipeline Security Branch uses the Pipeline Relative Risk Ranking Tool (risk assessment), which it developed in 2007, to assess various security risks of those systems. We previously reported, in 2010, that the Pipeline Security Branch was the first of TSA’s surface transportation modes to develop a risk assessment model that combined all three components of risk—threat, vulnerability, and consequence—to generate a risk score. The risk assessment generates a risk score for each of the 100 most critical pipeline systems and ranks them according to risk. The risk assessment calculates threat, vulnerability, and consequence for each pipeline system on variables such as the amount of throughput in the pipeline system and the number critical facilities. The risk assessment combines data collected from pipeline operators, as well as other federal agencies, such as the Departments of Transportation and Defense, to generate the risk score.

However, the last time the Pipeline Security Branch calculated relative risk among the top 100 critical pipeline systems using the risk assessment was in 2014. Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting CSRs state the results of the risk ranking are the primary factor considered when prioritizing corporate security reviews of pipeline companies. According to Pipeline Security Branch officials, the risk assessment has not changed since 2014 because the Pipeline Security Branch is still conducting CSRs based on the 2014 ranking of pipeline systems.

As outlined in table 4 below, we identified several factors that likely limit the usefulness of the current risk assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems. For example, because the risk assessment has not changed since 2014, information on threat may be outdated. Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented. For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor. Further, the risk assessment does not include information that is consistent with the NIPP and other DHS priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data).

According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk. Rather, officials said they are primarily interested in assessing risk data that impacts security. However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation would better align their efforts with PPD-21. For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts. For a more detailed discussion of the shortfalls we identified, refer to appendix II.

TSA’s Pipeline Risk Assessment Has Not Been Peer Reviewed to Help Validate the Data and Methodology

In addition to the shortfalls identified above, the risk assessment has not been peer reviewed since its conception in 2007. In our past work, we reported that independent, external peer reviews are a best practice in risk management and that independent expert review panels can provide objective reviews of complex issues. According to the National Research Council of the National Academies, external peer reviews should, among other things, address the structure of the assessment, the types and certainty of the data, and how the assessment is intended to be used. The National Research Council has also recommended that DHS improve its risk analyses for infrastructure protection by validating the assessments and submitting them to independent, external peer review.

Other DHS components have implemented our prior recommendations to conduct peer reviews of their risk assessments. For example, in April 2013, we reported on DHS’s management of its Chemical Facility Anti- Terrorism Standards (CFATS) program and found that the approach used to assess risk did not consider all of the elements of consequence, threat, and vulnerability associated with a terrorist attack involving certain chemicals. The Infrastructure Security Compliance Division, which manages the CFATS program conducted a multiyear effort to improve their risk assessment methodology and included commissioning a peer review by the Homeland Security Studies and Analysis Institute, which resulted in multiple recommendations. As part of the implementation of some of the peer review’s recommendations, DHS conducted peer reviews and technical reviews with government organizations and facility owners and operators, and worked with Sandia National Laboratories to verify and validate the CFATS program’s revised risk assessment methodology, which was completed in January 2017.

According to Pipeline Security Branch officials, they are considering updates to the risk assessment methodology including changes to the vulnerability and consequence factors. These officials said the risk assessment was previously reviewed within the past 18 months by industry experts and they consider input from several federal partners including DHS, DOT, and the Department of Defense. Officials also said they will consider input from industry experts and federal partners while working on updating the risk assessment. However, most of the proposed changes to the risk assessment methodology officials described are ones that have been deliberated since our last review in 2010. Therefore, an independent, external peer review would provide the opportunity for integration and analysis of additional outside expertise across the critical infrastructure community.

While independent, external peer reviews cannot ensure the success of a risk assessment approach, they can increase the probability of success by improving the technical quality of projects and the credibility of the decision-making process. According to the National Research Council of the National Academies, independent, external peer reviews should include validation and verification to ensure that the structure of the risk assessment is both accurate and reliable. Thus, an independent, external peer review would provide better assurance that the Pipeline Security Branch can rank relative risk among pipeline systems using the most comprehensive and accurate threat, vulnerability, and consequence information.

TSA Has Established Performance Measures, but Limitations Hinder TSA’s Ability to Determine Pipeline Security Program Effectiveness

TSA has established performance measures, as well as databases to monitor pipeline security reviews and analyze their results. However, weaknesses in its performance measures and its efforts to record pipeline security review recommendations limit its ability to determine the extent that its pipeline security program has reduced pipeline sector risks. Furthermore, we identified data reliability issues in the information that TSA collects to track the status of pipeline security review recommendations, such as missing data, inconsistent data entry formats, and data entry errors.

TSA Has Established Performance Measures but Faces Challenges in Assessing the Effectiveness of Its Efforts to Reduce Pipeline Security Risks

TSA has three sets of performance measures for its pipeline efforts: the Pipeline Security Plan in the 2018 Biennial National Strategy for Transportation Security (NSTS), a management measure in the DHS fiscal year 2019 congressional budget justification, and summary figures in their CSR and CFSR databases. As a result of our 2010 work, TSA established performance measures and linked them to Pipeline Security Plan goals within the Surface Security Plan of the 2018 NSTS. See table 5 below for the 2018 NSTS Pipeline Security Plan performance measures.

As shown in table 6 below, DHS also included a management measure in its fiscal year 2019 congressional budget justification to track the annual number of completed pipeline security reviews.

Finally, TSA Pipeline Security Branch officials said they use summary figures in the CFSR status database and the CSR goals and priorities database as performance measures. For example, these include the percentage of CFSR recommendations implemented and the average percentage compliance with the guidelines by fiscal year.

We previously found that results-oriented organizations set performance goals to clearly define desired program outcomes and develop performance measures that are clearly linked to the performance goals. Performance measures should focus on whether a program has achieved measurable standards toward achieving program goals, and allow agencies to monitor and report program accomplishments on an ongoing basis. Our previous work on performance metrics identified 10 attributes of effective performance. Table 7 identifies each key attribute of effective performance measures along with its definition.

We evaluated the current performance measures included in the 2018 NSTS, the DHS fiscal year 2019 congressional budget justification, the CSR goals and priorities database, and the CFSR status database related to TSA’s Pipeline Security Branch.

We primarily focused on key attributes which could be applied to individual measures. These include clarity, linkage, measurable targets, objectivity, reliability, and baseline and trend data. Our prior work on performance measurement found that all performance measure attributes are not equal and failure to have a particular attribute does not necessarily indicate that there is a weakness in that area or that the measure is not useful; rather, it may indicate an opportunity for further refinement.

Based on our evaluation, the TSA-identified measures do not possess attributes that we have identified as being key to successful performance measures. As a result, TSA cannot fully determine the extent to which the Pipeline Security Branch has achieved desired outcomes, including the effectiveness of its efforts to reduce risks to pipelines. Specifically, many of TSA’s measures cover agency goals and mission, but they generally lack clarity and measurable targets, provide significantly overlapping information, and do not include baseline and trend data.

Clarity. The pipeline-related measures in the 2018 NSTS are not clear because they do not describe the methodology used to calculate them, and the names and definitions are not clearly described. For example, NSTS goal 1 includes an objective to conduct training of employees responding to terrorist attacks. The desired outcome is to improve the capability of industry employees to respond and recover from terrorist attacks. However, the performance measure is the percentage of critical pipeline systems implementing the TSA Pipeline Security Guidelines. It is not clear if this measure is specific to the sections of the guidelines related to employee training or overall implementation of the guidelines. The CFSR status database measures include the percentage of recommendations implemented by topic, such as “Site Specific Security Measures,” “Signage,” or “Miscellaneous.” However, the database does not specifically define these topics or explain the methodology for calculating the measures. Unclear measures could be confusing and misleading to users.

Core program activities. The pipeline-related measures in the 2018 NSTS cover some of the agency’s core program activities, such as conducting security exercises with the pipeline industry and providing intelligence and information products to the industry. However, the NSTS Pipeline Security Plan measures do not specifically include some core program activities, such as updating the TSA Pipeline Security Guidelines or the results of conducting CSRs and CFSRs in order to collect the information necessary for the existing performance measures. The CSR goals and priorities database and the CFSR status database include measures intended to track some of the results of pipeline security reviews, such as the average percentage compliance with the guidelines by fiscal year and the percentage of CFSR recommendations implemented. If core program activities are not covered, there may not be enough information available in those areas to managers and stakeholders.

Limited overlap. The pipeline-related measures in the 2018 NSTS do not have limited overlap. As discussed previously, four of the five NSTS measures are based on the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines. The management measure is based on the number of complete pipeline security reviews. The CFSR status database measures are based on the percentage of recommendations implemented overall and by groups. Finally, the CSR goals and priorities database measures are based on the average compliance percentage of companies that had CSRs conducted in fiscal years 2016 and 2017. This is similar to four of the five NSTS measures. Significantly overlapping measures may lead to redundant, costly information that does not add value for TSA management.

Linkage. The pipeline-related measures in the 2018 NSTS generally exhibited this key attribute. For example, all of the NSTS measures were arranged by agency strategic goals and risk-based priorities. However, the management measure in DHS’s fiscal year 2019 congressional budget justification and the CFSR status database measures did not specify the TSA goals and priorities to which they were aligned. If measures are not aligned with division and agency- wide goals and mission, the behaviors and incentives created by these measures do not support achieving those goals or mission.

Measurable target. TSA’s measures generally did not include measurable targets in the form of a numerical goal and none of the NSTS measures had measurable targets. For example, the NSTS measure under the Security Planning priority, which tracks the percentage of critical pipeline systems implementing TSA’s Pipeline Security Guidelines, does not state what specific percentages would be considered an improvement in industry security plans. However, the management measure did include target numbers of pipeline security reviews by fiscal year. Both the CFSR status database measures and CSR goals and priorities database measures did not include measurable targets. Without measurable targets, TSA cannot tell if performance is meeting expectations.

Objectivity. Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity and measurable targets, TSA cannot ensure its measures are free from bias or manipulation, and therefore, are not objective. If measures are not objective, the results of performance assessments may be systematically overstated or understated.

Reliability. Because the pipeline-related measures in the 2018 NSTS, the CFSR status database, and the CSR goals and priorities database generally lack clarity, measurable targets, and baseline and trend data, it is not clear if TSA’s measures produce the same result under similar conditions; therefore, the pipeline-related measures are unreliable. If measures are not reliable, reported performance data may be inconsistent and add uncertainty.

Baseline and trend data. TSA’s measures generally did not include baseline and trend data. For example, none of the NSTS measures included past results and compared them to measurable targets. TSA officials were unable to identify measures or goals to assess the extent to which pipeline operators have fully implemented the guidelines or increased pipeline security, but did say developing a feedback mechanism to measure progress in closing vulnerability gaps was important. However, the management measure did include the number of completed pipeline security reviews for each fiscal year from 2014 through 2017, as well as numerical goals. The CFSR status database includes information on CFSRs conducted from May 22, 2012, through June 29, 2017, but the measures are calculated for the entire time period rather than year-by-year. The CSR goals and priorities database measures include percentage compliance with the guidelines for CSRs conducted in fiscal years 2016 and 2017, as well as a combined measure. However, baseline and trend data are not tracked or reported in either database. Collecting, tracking, developing, and reporting baseline and trend data allows agencies to better evaluate progress being made and whether or not goals are being achieved.

Pipeline Security Branch officials explained that in addition to the measures reported in the 2018 NSTS Pipeline Security Plan, they primarily rely on measures assessing CSR and CFSR implementation for assessing the value of its pipeline security program. TSA officials reported that they collect and analyze data and information collected from CSRs and CFSRs to, among other things, determine strengths and weaknesses at critical pipeline facilities, areas to target for risk reduction strategies, and pipeline industry implementation of the voluntary Pipeline Security Guidelines. For example, TSA officials reported that they analyzed information from approximately 734 CFSR recommendations that were made during fiscal years 2012 through 2016. They found that pipeline operators had made the strongest improvements in security training, public awareness outreach and law enforcement coordination, and site specific security measures. The most common areas in need of improvement were 24x7 monitoring, frequency of security vulnerability assessments, and proper signage.

However, as described above, we found those measures also did not comport with key attributes for successful measures and we report below on reliability concerns for underlying data supporting those measures. In addition, while the Pipeline Security Branch may not rely on the measures included in the 2018 NSTS Pipeline Security Plan and the fiscal year 2019 congressional budget justification, they are important for reporting the status of pipeline security efforts to TSA as a whole and to external stakeholders such as Congress.

Taking steps to ensure that the pipeline security program performance measures exhibit key attributes of successful performance measures could allow TSA to better assess the program’s effectiveness at reducing pipeline physical and cybersecurity risks. This could include steps such as modifying its suite of measures so they are clear, have measurable targets, and add baseline and trend data. Further examples include the following:

Adding measurable targets consisting of numerical goals could allow TSA to better determine if the pipeline security program is meeting expectations. For example, measurable targets could be added to TSA’s existing measures by developing annual goals for the percentage of recommendations implemented to the CFSR status database and then reporting annual results.

To make measures clearer, TSA could verify that each measure has a clearly stated name, definition, and methodology for how the measure is calculated. For example, the NSTS objective for security training mentioned above could have more specific language explaining how the measure is calculated and whether it applies to pipeline operators’ implementation of the training-related portions of the TSA Pipeline Security Guidelines or overall implementation.

Finally, adding baseline and trend data could allow TSA to identify, monitor, and report changes in performance and help ensure that performance is viewed in context. For example, the NSTS measures, CFSR status database measures, and CSR goals and priorities database measures could have annual results from prior years. This could help TSA and external stakeholders evaluate the effectiveness of the pipeline security program and whether it is making progress toward its goals.

TSA Does Not Track the Implementation Status of Past CSR Recommendations, and Supporting Data Are Not Sufficiently Reliable

According to TSA officials, the primary means for assessing the effectiveness of the agency’s efforts to reduce pipeline security risks is through conducting pipeline security reviews— Corporate Security Reviews (CSRs) and Critical Facility Security Reviews (CFSRs). However, TSA has not tracked the status of CSR recommendations for over 5 years and related security review data are not sufficiently reliable.

When conducting CSRs and CFSRs, TSA staff makes recommendations to operators, if appropriate. For example, a CSR recommendation might include a suggestion to conduct annual security-related drills and exercises, and a CFSR recommendation might include a suggestion to install barbed wire on the main gate of a pipeline facility. In response to recommendations that we made in our 2010 report, TSA developed three databases to track CSR and CFSR recommendations and their implementation status by pipeline facility, system, operator, and product type. In addition, the agency recently developed a fourth database to collect and analyze information gathered from pipeline operators’ responses to CSR questions. TSA officials reported that they use this database to assess the extent that TSA’s pipeline security program has met NSTS goals and Pipeline Security Branch priorities. TSA officials stated that they use the CSR goals and priorities database for follow-up on recommendations, indications of improvement in pipeline security, and as an input into TSA performance goals and measures, including the performance measures for the 2018 NSTS Pipeline Security Plan.

We found several problems with the databases that indicate that the pipeline security program data are not sufficiently reliable and do not provide quality information that is current, complete, and accurate. First, the CSR recommendations database only included information for reviews conducted from November 2010 through February 2013. TSA officials stated that the agency stopped capturing CSR recommendations and status information in 2014. A TSA official stated that one factor was that the pipeline staffing level was one FTE in fiscal year 2014. However, the Pipeline Security Branch did not resume entering CSR recommendation-related information when staffing levels rose to 6 FTEs in the following year and beyond. As a result, TSA is missing over 5 years of data for the recommendations it made to pipeline operators when conducting CSRs.

The agency collected some information from CSRs conducted in fiscal years 2016 and 2017 in the separate CSR goals and priorities database. However, this database does not include all of the information that TSA collects when conducting CSRs. Specifically, the CSR goals and priorities database does not state which companies were reviewed, what specific recommendations were made, or the current status of those recommendations, and only records operators’ responses to 79 of the 222 CSR questions.

Second, our review identified instances of missing data, inconsistent data entry formats, and data entry errors in the four databases. For example:

The CSR recommendations database had missing data in all 13 of the included fields and a data entry error shifted 50 observations into the wrong fields, impacting both the Status Date and Completion Code fields.

The CSR goals and priorities database had seven entries with inconsistent data formatting and five of those entries were not taken into account when calculating summary figures.

The CFSR recommendations database had missing data in 3 of 9 fields. There was also inconsistent data entry formats in 3 fields.

The CFSR status database had missing data in 7 of 29 fields and inconsistent data entry formats in 4 fields.

Finally, TSA has not documented its data entry and verification procedures, such as in a data dictionary or user manual, and does not have electronic safeguards for out-of-range or inconsistent entries for any of the databases it uses to track the status of CSR or CFSR recommendations and analyze operator responses to the CSR. TSA Pipeline Security Branch officials told us that they had not documented data entry and verification procedures and did not have electronic safeguards. This was for two reasons. First, the officials stated that the databases are small and maintained in a commercial spreadsheet program that does not allow for electronic safeguards. However, based on our review of the databases, the spreadsheet program does allow for a variety of electronic safeguards. For example, entries can be restricted to only allow selections from a drop-down list or only allow dates to be entered. Second, only a small number of TSA employees enter information into these databases. TSA officials explained that typically one TSA employee is responsible for entering information from pipeline security reviews, and another individual, usually whoever conducted the review, is tasked to verify the accuracy of the data entered. As a result, according to the officials, any errors would be self-evident and caught during these TSA employees’ reviews.

Our work has emphasized the importance of quality information for management to make informed decisions and evaluate agencies’ performance in achieving key objectives and addressing risks. The Standards for Internal Control in the Federal Government states that management should use quality information to achieve agency objectives, where “quality” means, among other characteristics, current, complete, and accurate. In addition, DHS’s Information Quality Guidelines state that all DHS component agencies should treat information quality as integral to every step of the development of information, including creation, collection, maintenance, and dissemination. The guidelines also state that agencies should substantiate the quality of the information disseminated through documentation or other appropriate means.

Without current, complete, and accurate information, it is difficult for TSA to evaluate the performance of the pipeline security program. Until TSA monitors and records the status of these reviews’ recommendations, it will be hindered in its efforts to determine whether its recommendations are leading to significant reduction in risk. By entering information on CSR recommendations and monitoring and recording their status, developing written documentation of its data entry and verification procedures and electronic safeguards, and improving the quality of its pipeline security program data, TSA could better ensure it has the information necessary to effectively monitor pipeline operators’ progress in improving their security posture, and evaluate its pipeline security program’s effectiveness in reducing security risks to pipelines.

Conclusions

A successful pipeline attack could have dire consequences on public health and safety, as well as the U.S. economy. Recent coordinated campaigns by environmental activists to disrupt pipeline operations, and the successful attempts by nation-state actors to infiltrate and obtain sensitive information from pipeline operators’ business and operating systems, demonstrate the dynamic and continuous threat to the security of our nation’s pipeline network.

To help ensure the safety of our pipelines throughout the nation, it is important for TSA to address weaknesses in the management of its pipeline security program. TSA’s Pipeline Security Branch revised its security guidelines in March 2018 to, among other things, reflect the dynamic threat environment and incorporate NIST’s Cybersecurity Framework cybersecurity principles and practices. However, without a documented process defining how frequently TSA is to review and, if deemed necessary, revise its guidelines, TSA cannot ensure that its guidelines reflect the latest known standards and best practices for physical and cybersecurity, or address the persistent and dynamic security threat environment currently facing the nation’s pipeline system. Further, without clearly defined criteria for determining pipeline facilities’ criticality, TSA cannot ensure that pipeline operators are applying guidance uniformly and that all of the critical facilities across the pipeline sector have been identified; or that their vulnerabilities have been identified and addressed.

TSA could improve its ability to conduct pipeline security reviews and the means that it uses to prioritize which pipeline systems to review based on their relative risk ranking. Establishing a strategic workforce plan could help TSA ensure that it has identified the necessary skills, competencies, and staffing allocations that the Pipeline Security Branch needs to carry out its responsibilities, including conducting security reviews of critical pipeline companies and facilities, as well as their cybersecurity posture. Better considering threat, vulnerability, and consequence elements in its risk assessment and incorporating an independent, external peer review in its process would provide more assurance that the Pipeline Security Branch ranks relative risk among pipeline systems using comprehensive and accurate data and methods.

Recommendations for Executive Action

We are making 10 recommendations to TSA:

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to implement a documented process for reviewing, and if deemed necessary, for revising TSA’s Pipeline Security Guidelines at regular defined intervals. (Recommendation 1)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to clarify TSA’s Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. (Recommendation 2)

The TSA Administrator should develop a strategic workforce plan for its Security Policy and Industry Engagement’s Surface Division, which could include determining the number of personnel necessary to meet the goals set for its Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs. (Recommendation 3)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to update the Pipeline Relative Risk Ranking Tool to include up-to-date data to ensure it reflects industry conditions, including throughput and threat data. (Recommendation 4)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to fully document the data sources, underlying assumptions and judgments that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment. (Recommendation 5)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. (Recommendation 6)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach. (Recommendation 7)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, and baseline and trend data. (Recommendation 8)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to take steps to enter information on CSR recommendations and monitor and record their status. (Recommendation 9)

The TSA Administrator should direct the Security Policy and Industry Engagement’s Surface Division to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors. (Recommendation 10)

Agency Comments and Our Evaluation

We provided a draft of this report to DHS, DOE, DOT, and FERC. DHS provided written comments which are reproduced in appendix III. In its comments, DHS concurred with our recommendations and described actions planned to address them. DHS, DOE, DOT, FERC, also provided technical comments, which we incorporated as appropriate. We also provided draft excerpts of this product to the American Petroleum Institute (API), the Association of Oil Pipe Lines, the American Gas Association (AGA), the Interstate Natural Gas Association of America (INGAA), the American Public Gas Association, and the selected pipeline operators that we interviewed. For those who provided technical comments, we incorporated them as appropriate.

With regard to our first recommendation, that TSA implement a documented process for reviewing, and if deemed necessary, for revising its Pipeline Security Guidelines at regular defined intervals, DHS stated that TSA will implement a documented process for reviewing and revising its Pipeline Security Guidelines at regular defined intervals, as appropriate. DHS estimated that this effort would be completed by March 31, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our second recommendation, that TSA clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities, DHS stated that TSA will clarify its Pipeline Security Guidelines by defining key terms within its criteria for determining critical facilities. DHS estimated that this effort would be completed by May 31, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our third recommendation, that TSA develop a strategic workforce plan for its Security Policy and Industry Engagement's Surface Division, DHS stated that TSA will develop a strategic workforce plan for the division, which includes determining the number of personnel necessary to meet the goals set for the Pipeline Security Branch, as well as the knowledge, skills, and abilities, including cybersecurity, that are needed to effectively conduct CSRs and CFSRs. DHS estimated that this effort would be completed by June 30, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our fourth recommendation, that TSA update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data, DHS stated that TSA will update the Pipeline Relative Risk Ranking Tool to include up-to-date data in order to ensure it reflects industry conditions, including throughput and threat data. DHS estimated that this effort would be completed by February 28, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our fifth recommendation, that TSA fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool, including sources of uncertainty and any implications for interpreting the results from the assessment, DHS stated that TSA will fully document the data sources, underlying assumptions, and judgements that form the basis of the Pipeline Relative Risk Ranking Tool. According to DHS, this will include sources of uncertainty and any implications for interpreting the results from the assessment. DHS estimated that this effort would be completed by February 28, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our sixth recommendation, that TSA identify or develop other data sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities and incorporate that data into the Pipeline Relative Risk Ranking Tool to assess relative risk of critical pipeline systems, DHS stated that TSA will identify and/or develop other sources relevant to threat, vulnerability, and consequence consistent with the NIPP and DHS critical infrastructure risk mitigation priorities. DHS also stated that TSA will incorporate that data into the Pipeline Risk Ranking Tool to assess relative risk of critical pipeline systems, which could include data on prior attacks, natural hazards, feedback data on pipeline system performance, physical pipeline condition, and cross-sector interdependencies. DHS estimated that this effort would be completed by June 30, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our seventh recommendation, that TSA take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool, after the Pipeline Security Branch completes enhancements to its risk assessment approach, DHS stated that, after completing enhancements to its risk assessment approach, TSA will take steps to coordinate an independent, external peer review of its Pipeline Relative Risk Ranking Tool. DHS estimated that this effort would be completed by November 30, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our eighth recommendation, that TSA ensure that the Security Policy and Industry Engagement's Surface Division has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data, DHS stated that TSA’s Surface Division’s Pipeline Section will develop both physical and cyber security performance measures, in consultation with pipeline stakeholders, to ensure that it has a suite of performance measures which exhibit key attributes of successful performance measures, including measurable targets, clarity, baseline, and trend data. DHS estimated that this effort would be completed by November 30, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our ninth recommendation, that TSA take steps to enter information on CSR recommendations and monitor and record their status, DHS stated that TSA will enter information on CSR recommendations and monitor and record their status. DHS estimated that this effort would be completed by October 31, 2019. This action, if fully implemented, should address the intent of the recommendation.

With regard to our tenth recommendation, that TSA take steps to improve the quality of its pipeline security program data by developing written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors, DHS stated that TSA will develop written documentation of its data entry and verification procedures, implementing standardized data entry formats, and correcting existing data entry errors. DHS estimated that this effort would be completed by July 31, 2019. This action, if fully implemented, should address the intent of the recommendation.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until one day from the report date. At that time, we will send copies to the appropriate congressional committees; the Secretaries of Energy, Homeland Security, and Transportation; the Executive Director of the Federal Energy Regulatory Committee; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Chris Currie at (404) 679-1875 or curriec@gao.gov, and Nick Marinos at (202) 512-9342 or marinosn@gao.gov. Key contributors to this report are listed in appendix IV.

Appendix I: Federal and Industry Security Guidelines and Standards for the Pipeline Sector

This appendix lists security guidance and guidance-related tools that the pipeline operators and industry association officials we interviewed identified as adopted or available in order to secure their physical and cyber operations. This list should not be considered to include all physical and cybersecurity guidance that may be available or used by all pipeline operators nor do all operators use all guidance listed.

Appendix II: Description of Areas for Improvement in the Pipeline Security Branch’s Pipeline Relative Risk Ranking Tool

The Transportation Security Administration’s (TSA) Pipeline Security Branch developed the Pipeline Relative Risk Ranking Tool (risk assessment) in 2007. The risk assessment calculates threat, vulnerability, and consequence on variables such as the amount of throughput in the pipeline system (consequence input). Pipeline Security Branch officials told us that they use the pipeline risk assessment to rank relative risk of the top 100 critical pipeline systems, and the standard operating procedures for conducting Corporate Security Reviews (CSR) state the results of the risk ranking are the primary factor considered when prioritizing CSRs of pipeline companies.

However, we identified several factors that likely limit the usefulness of the current assessment in calculating threat, vulnerability, and consequence to allow the Pipeline Security Branch to effectively prioritize reviews of pipeline systems. For example, because the risk assessment has not changed since 2014, information on threat may be outdated. Additionally, sources of data and underlying assumption and judgments regarding certain threat and vulnerability inputs to the assessment are not fully documented. For example, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology, making it unclear if cybersecurity is part of the assessment’s threat factor. Further, the risk assessment does not include information that is consistent with the National Infrastructure Protection Plan (NIPP) and other Department of Homeland Security (DHS) priorities for critical infrastructure risk mitigation, such as information on natural hazards and the ability to measure risk reduction (feedback data).

According to Pipeline Security Branch officials, the risk ranking assessment is not intended to be a fully developed risk model detailing all pipeline factors influencing risk. Rather, officials said they are primarily interested in assessing risk data that impacts security. However, because TSA’s Pipeline Security Program is designed to enhance the security preparedness of the pipeline systems, incorporating additional factors that enhance security into their risk calculation of the most critical pipeline systems would better align their efforts with Presidential Policy Directive 21 (PPD-21). For example, PPD-21 calls for agencies to integrate and analyze information to prioritize assets and manage risks to critical infrastructure, as well as anticipate interdependencies and cascading impacts.

Below we present the various shortfalls in the risk assessment—outdated data, limited description of sources and methodology, and opportunities to better align with the NIPP and other DHS priorities for critical infrastructure risk mitigation—in the context of the components that comprise a risk assessment: threat, vulnerability, and consequence. Whereas in 2010 we made recommendations to improve the consequence component in the pipeline relative risk ranking tool, we have currently identified shortfalls that cut across all risk components: threat, vulnerability, and consequence.

Threat

We identified several shortfalls in the pipeline risk assessment’s calculation of threat. First, while the risk assessment assesses consequence and vulnerability by pipeline system through use of multiple variables, it currently ranks threat for pipeline systems equally. Second, the evolving nature of threats to pipelines may not be reflected, since the risk assessment was last updated in 2014. Third, the threat calculation does not take into account natural hazards.

Pipeline Security Branch officials said they currently rank threat equally across pipeline systems because they do not have granular enough threat information to distinguish threat by pipeline. However, ranking threat equally effectively has no effect on the risk calculation for pipeline systems. Further, this judgment is not documented in the risk assessment’s methodology. According to the NIPP, a risk assessment’s methodology must clearly document what information is used and how it is synthesized to generate a risk estimate, including any assumptions and judgments. Additionally, our analysis of the pipeline risk assessment found that it includes at least one field that TSA could use to differentiate threat by pipeline. Specifically, the risk assessment includes a field that accounts for whether a pipeline experienced a previous security threat (including failed attacks), and information provided by Pipeline Security Branch suggests some pipeline systems have experienced such threats.

However, the Pipeline Security Branch did not capture these events in the risk assessment’s calculation, which Pipeline Security Branch officials said should be part of the threat calculation, but could not account for why they were not calculated for the systems in the risk assessment. These officials also clarified that incidents such as suspicious photography or vandalism do not constitute an attack to be accounted for in the threat calculation. Documenting such assumptions, judgments, or decisions to exclude information could provide increased transparency to those expected to interpret or use the results.

Pipeline Security Branch officials also said that they ranked threat equally because TSA Intelligence and Analysis data show that threats to the oil and natural gas sector have been historically low, and Intelligence and Analysis does not conduct specific threat analysis against individual pipeline systems. However, the Pipeline Security Branch has not updated the risk assessment since June 2014; therefore, the threat information it used to determine threat calculations—and decide to rank threat equally—may be outdated and not reflect the threats to the industry that have emerged in recent years. In fact, pipeline operators we interviewed indicated that the types of threats that concern pipeline operators have evolved. For example, 5 of the 10 operators we interviewed indicated that environmental activists were an increased threat to the pipeline industry because they use sabotage techniques, such as valve turning and cutting in service pipelines with blow torches, against pipelines. Additionally, 6 of 10 pipeline operators we interviewed said cyber attacks from nation-state actors were a primary threat to their industry. Further, when TSA issued its revised Pipeline Security Guidelines in March 2018, it stated that its revisions to the guidelines were made to reflect the ever-changing threat environment in both the physical and cybersecurity realms. However, threats to cybersecurity are not specifically accounted for in the description of the risk assessment methodology. Recent Pipeline Modal and Cyber Modal Threat Assessments include cyber threats to the pipeline industry, but the description of the pipeline risk assessment’s methodology does not specify what types of threat assessments (sources) are used to calculate its threat score. To better align with the guidance in the NIPP for documenting sources of information when conducting risk assessments, the Pipeline Security Branch should document the information used. Keeping the risk assessment updated with current information, as well as documenting those data sources, could help the Pipeline Security Branch ensure it is using its limited resources to review the pipeline systems with greater risk.

Natural Hazard Threats to Pipelines The Transportation Systems Sector, of which pipelines are a part, is critical to the Pacific Northwest, but also at risk from natural hazards, like earthquakes. For example, according to the Department of Homeland Security, an earthquake in the Puget Sound region—which relies on the transportation of crude oil from Alaska—could cripple the ports of Seattle and Tacoma, as well as the Olympic and Williams Pipelines greatly impacting the Pacific Northwest Economic Region. Hurricanes are the most frequent disruptive natural hazard for the oil and natural gas subsector and can cause the shutdown of facilities in an area, even when the facilities themselves are not directly affected by the storms. For example, according to the U.S. Energy Information Administration, the flow of petroleum into the New York area via pipeline from the Gulf Coast relies on the ability to move it through major terminals. In August 2017, Hurricane Harvey caused major disruptions to crude oil and petroleum product supply chains, including those to New York Harbor from Houston, Texas via the Colonial Pipeline. Due to the hurricane, decreased supplies of petroleum products available for the pipeline in Houston forced Colonial Pipeline to limit operations temporarily.

Finally, another shortfall in the current pipeline risk assessment methodology is that it does not account for natural hazards in its threat calculation, even though DHS’s definition of threat includes natural hazards, and security and resilience of critical infrastructure are often presented in the context of natural hazards. According to the NIPP, threat is a natural or manmade occurrence, individual, entity, or action that has or indicates the potential to harm life, information, operations, the environment, and/or property. As such, along with terrorism, criminal activity and cybersecurity, natural disasters are a key element of DHS’s critical infrastructure security and resilience mission.

According to Pipeline Security Branch officials, there is not sufficient historical data available that would indicate a significant impact from natural disasters on specific pipeline systems. However, we identified possible sources of data for the Pipeline Security Branch to consider. For example, a 2016 RAND Corporation study examined national infrastructure systems’ exposure to natural hazards, including pipelines. Additionally, the Federal Emergency Management Agency (FEMA) has collaborated with stakeholders to develop the National Risk Index to, among other things, establish a baseline of natural hazards risk for the United States While there may not be historical data of natural hazard impact for every pipeline system, consulting other sources or experts could provide regional data or analysis to build a more comprehensive threat picture to help distinguish threats by pipeline system. According to the NIPP, hazard assessments should rely not only on historical information, but also future predictions about natural hazards to assess the likelihood or frequency of various hazards.

Vulnerability

We also identified multiple shortfalls in the vulnerability factors used in the risk assessment methodology, such as the potential uncertainty of the number of critical facilities and incorporating a feedback mechanism to calculate overall risk reduction. Other considerations for vulnerability calculations include physical condition of the pipeline system, cybersecurity activities, and interdependencies among sectors.

The number of critical facilities a pipeline system has identified is used as an input for its vulnerability calculation in the Pipeline Security Branch’s risk assessment methodology. As discussed earlier, we identified deficiencies in TSA’s criteria for identifying critical facilities, and found that well-defined criteria and consistent application of the criteria for identifying critical facilities could improve the results of the Pipeline Security Branch’s risk assessment. Nevertheless, communicating in the risk assessment the uncertainty that may be inherent in this self-reported information would better align the risk assessment with the NIPP.

Measuring Effectiveness in a Voluntary Environment According to the National Infrastructure Protection Plan, the use of performance metrics is an important step in the critical infrastructure risk management process to enable assessment of improvements in critical infrastructure security and resilience. The metrics provide a basis for the critical infrastructure community to establish accountability, document actual performance, promote effective management, and provide a feedback mechanism to inform decision making. By using metrics to evaluate the effectiveness of voluntary partnership efforts to achieve national and sector priorities, critical infrastructure partners can adjust and adapt their security and resilience approaches to account for progress achieved, as well as changes in the threat and other relevant environments. Metrics are used to focus attention on areas of security and resilience that warrant additional resources or other changes through an analysis of challenges and priorities at the national, sector, and owner/operator levels. Metrics also serve as a feedback mechanism for other aspects of the critical infrastructure risk management approach.

Another shortfall in the risk assessment is its inability to reliably measure the progress a pipeline system made in addressing vulnerability gaps between security reviews. The current risk assessment includes a CSR score as part of its vulnerability calculation, which was developed in part in response to our 2010 recommendation to use more reliable data to measure a pipeline system’s vulnerability gap. However, during our review, Pipeline Security Branch officials said they plan to remove pipeline companies’ CSR scores from the risk assessment calculations, because they and industry partners do not have confidence that the score appropriately measures a pipeline system’s vulnerability. For example, Pipeline Security Branch officials explained that pipeline companies consider security factors differently, which can lead to variation in implementing risk reduction activities and by extension lead to different CSR scores. However, removing the CSR score eliminates the only feedback mechanism in the risk assessment from a pipeline company’s actual security review conducted by the Pipeline Security Branch. The NIPP and DHS’s Risk Management fundamentals emphasize the important role that such feedback mechanisms play in risk management. Officials from the Pipeline Security Branch agree on the importance of a feedback mechanism tying results of reviews to a revised vulnerability metric, but said they need a better measure than the current CSR score which is unreliable for comparative and analytic purposes. Developing a feedback mechanism based on implementation of TSA’s Pipeline Security Guidelines could be an important input to the risk assessment’s vulnerability calculation. This information would also inform the amount of risk pipeline companies are reducing by implementing the guidelines and could be used to inform overall risk reduction.

The physical and cyber environments in which the pipeline sector operates also present vulnerabilities not accounted for in the pipeline risk assessment. In recent years, DHS has listed the potential for catastrophic losses to dramatically increase the overall risk associated with failing infrastructure and highlighted risks due to climate change and natural hazards to pipelines. For example, DHS reported extreme temperatures—such as higher and lower temperatures over prolonged periods of time—increase vulnerability to the critical infrastructure by causing elements to break and cease to function. Pipelines that freeze and then rupture can affect the energy and transportation systems sectors. As noted above, according to the NIPP, a natural or man-made occurrence or action with the potential to harm life is considered a threat, whereas vulnerability is defined as a physical feature or operational attribute that renders an entity open to exploitation or susceptible to a given threat or hazard. While pipeline physical condition is typically thought of in context of safety, pipeline condition or location (such as above or below ground) could touch upon pipeline security as it relates to system vulnerability. For example, a pipeline system or segment of a system with a compromised physical condition due to corrosion or age could affect the system’s vulnerability to threats and affect its ability to recover from such threats by potentially increasing the time a system is offline.

According to the Transportation Systems Sector-Specific Plan, vulnerabilities to damage in aging transportation infrastructure—of which pipelines are a part—are projected to increase with the continued effects of climate change. Further, according to TSA’s Pipeline Security and Incident Recovery Protocol Plan, pipeline integrity efforts—including the design, construction, operation, and maintenance of pipelines—are important to pipeline security because well-maintained, safe pipelines are more likely to tolerate a physical attack. The Pipeline Security Branch already collects information from the Pipeline and Hazardous Materials Safety Administration (PHMSA) for its risk assessment, specifically information on High Consequence Area and High Threat Urban Area mileage. By considering additional information PHMSA collects on pipeline integrity, the Pipeline Security Branch could also use the information to help pipeline operators identify security measures to help reduce the consequences related to the comparatively higher vulnerability of an aging or compromised system. This would align with the Pipeline Security Branch’s efforts to improve security preparedness of pipeline systems and could better inform its vulnerability calculations for relative risk ranking of pipeline systems.

Capturing cybersecurity in the risk assessment is also an area for improvement. Pipeline Security Branch officials told us they consulted with the National Cybersecurity and Communications Integration Center to revise TSA’s Pipeline Security Guidelines to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and that absent data specific to pipelines on their cybersecurity vulnerabilities, they are unable to include a pipelines’ vulnerability to cyber attack in the risk assessment. However, the Pipeline Security Branch recently updated the security review questions asked of pipeline operators during corporate and critical facility reviews based on the recently updated Pipeline Security Guidelines. Using these updated questions related to companies’ cybersecurity posture, the Pipeline Security Branch could collect additional information on cybersecurity vulnerabilities which could inform the risk assessment. This could be an element of the feedback mechanism described above and emphasized in the NIPP. Additionally, NIST identified several supply chain vulnerabilities associated with cybersecurity, which are not currently accounted for in TSA’s Pipeline Security Guidelines. As pipeline operators implement increasing levels of network technologies to control their systems, the Pipeline Security Branch may not be fully accounting for pipeline systems’ cybersecurity posture by not including the cybersecurity-related vulnerabilities in its risk assessment inputs.

Finally, we identified shortfalls in cross-sector interdependencies, which could affect vulnerability calculations. According to the NIPP, understanding and addressing risks from cross-sector dependencies and interdependencies is essential to enhancing critical infrastructure security and resilience. The Pipeline Security Branch’s pipeline risk assessment currently considers the effects of a pipeline system’s ability to service assets such as major airports, the electric grid, and military bases. However, consequence is calculated on the loss or disruption of the pipeline system to these other assets and does not capture the dependency of the pipeline system on other energy sources, such as electricity. Weather events such as Gulf of Mexico hurricanes and Superstorm Sandy highlighted the interdependencies between the pipeline and electrical sectors. Specifically, according to a 2015 DHS annual report on critical infrastructure, power failures during Superstorm Sandy in 2012 closed major pipelines for 4 days, reducing regional oil supplies by 35 to 40 percent. The report goes on to say that the interconnected nature of infrastructure systems can lead to cascading impacts and are increasing in frequency. Pipeline Security Branch officials are considering cross-sector interdependencies and said they discuss these factors with operators as they relate to system resiliency. Considering interdependencies of sectors in both directions—such as calculating the likelihood that an input like electricity could fail and cause disruptions to critical pipelines—could improve the calculations in the pipeline risk assessment.

Consequence

As previously discussed, the Pipeline Security Branch last calculated relative risk among the top 100 pipeline systems in 2014. When doing so, it used pipeline systems’ throughput data from 2010 to assess relative risk. According to Pipeline Security Branch officials, the amount of throughput in pipeline systems does not change substantially year to year. However, Standards for Internal Control in the Federal Government calls for management to use quality information to achieve the entity’s objectives, including using relevant data from reliable sources obtained in a timely manner. The Pipeline Security Branch uses throughput data as a consequence factor in the risk assessment to determine a pipeline system’s relative risk score. Throughput changes could affect relative risk ranking and the Pipeline Security Branch’s ability to accurately prioritize reviews based on relative risk.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Chris P. Currie at (404) 679-1875 or curriec@gao.gov Nick Marinos at (202) 512-9342 or marinosn@gao.gov.

Staff Acknowledgments

In addition to the contacts named above, Ben Atwater, Assistant Director; Michael W. Gilmore, Assistant Director; and Michael C. Lenington, Analyst-in-Charge, managed this assignment. Chuck Bausell, David Blanding, Dominick Dale, Eric Hauswirth, Kenneth A. Johnson, Steve Komadina, Susanna Kuebler, Thomas Lombardi, David Plocher, and Janay Sam made significant contributions to this report.