Pipeline Security: An Overview of Federal Activities and Current Policy Issues
Released: 2004-02-05T00:00:00

Introduction

Nearly half a million miles of oil and gas transmission pipeline crisscross the United States. (1) These pipelines are integral to U.S. energy supply and have vital links to other critical infrastructure,like power plants, airports, and military bases. While an efficient and fundamentally safe means oftransport, many pipelines carry volatile or flammable materials with the potential to cause publicinjury and environmental damage. The nation's pipeline networks are also widespread, runningalternately through remote and densely populated regions; consequently, these systems are inherentlyvulnerable to terrorist attack. Pipeline operators have had security and emergency response programsin place for decades, but they have recently been taking steps to enhance those programs in responseto new terrorist threats. Congress passed legislation to further encourage the pipeline industry toadopt better security practices, and to provide federal oversight of operator security programs ( P.L.107-71 , P.L. 107-296 , P.L. 107-355 ). Policy makers are now examining the progress and adequacyof these efforts.

This report provides an overview of recent federal activities related to pipeline security, including safety activities with links to security. The report describes the U.S. gas and oil pipelinenetworks, the industry's safety record and security risks, and the industry's security activities sinceSeptember 11, 2001. It summarizes recent changes in federal pipeline security law and relatedchanges in the security roles of federal agencies. The report discusses several policy concerns relatedto federal pipeline security efforts: 1) federal threat information for pipelines, 2) criteria foridentifying "critical"assets, 3) TSA funding for pipeline security, and 4) federal agency cooperationin pipeline security.

Scope and Limitations

While this report addresses many safety issues related to security, it does not cover the full range of safety issues of potential interest to policy makers (e.g., inspection technology). Becausethe focus of this report is on activities and policies of federal agencies, it does not examine statepipeline agency activities in depth. The report also focuses on TSA and the OPS as the lead pipelinesecurity and safety agencies. The activities of federal agencies with more limited roles in pipelinesecurity and safety are reviewed in the Appendix.

Oil and Gas Pipeline Industry Overview

Some 470,000 miles of oil and gas transmission pipeline crisscross the United States, with linksto Mexico and Canada. These pipelines run throughout the country, but the greatest concentrationconnects the major energy-producing regions in the South with the major energy-consuming regionsin the Northeast ( Figure 1 ).

Source: Energy Information Administration

There are roughly 180,000 miles of oil pipeline in the United States carrying over 75% of the nation's crude oil and around 60% of its refined petroleum products. (2) Some 180 companies operatethe inter state lines, which account for roughly 80 % of total pipeline mileage and transportedvolume. (3) The largest U.S. pipeline is the TransAlaska Pipeline System (TAPS), which transportscrude oil from Alaska's North Slope oil fields to the marine terminal in Valdez. TAPS runs some800 miles and delivers roughly 17% of United States domestic oil production. (4) Like TAPS, majoroil pipelines generally terminate at logistics hubs which typically link multiple pipelines, maintainsubstantial storage facilities and serve as gateways for regional distribution by truck, tanker, barge,or other means.

The U.S. natural gas pipeline network consists of around 210,000 miles of inter state transmission, plus approximately 75,000 miles of intra state transmission. (5) Around 80 systems makeup the inter state network. Another 60 or so systems operate strictly within individual states. (6) These inter state and intra state transmission pipelines feed around 1.1 million miles of regionallines insome 1,300 local distribution networks. (7) Collectively, these gas pipelines transport nearly all of thenatural gas in the United States. Gas pipelines serve electric generation and industrial customersdirectly, and link through "city gates" to regional distribution mains which, in turn, feed the localservice lines of retail gas consumers. Some pipelines are also connected to liquefied natural gas(LNG) storage tanks which augment pipeline gas supplies during peak demand periods. Accordingto the Department of Energy, there are 113 active LNG facilities in the U.S., mostly in the Northeast, many located near populated areas. (8)

Safety Record of the Pipeline Industry

Taken as a whole, releases from pipelines cause relatively few annual fatalities. Oil pipelines reported an average of 1.4 deaths per year from 1997-2001. Gas pipelines reported an average of18.6 deaths per year during the same period. (9) It isdifficult to make direct safety comparisonsbetween pipelines and other transportation modes due to data limitations. Nonetheless, DOTstatistics suggest that pipelines have much lower fatalities per ton-mile of general freight moved thantruck, rail or waterborne transport. In general, the environmental safety record of oil pipelines iscomparable to other transportation modes. According to the oil industry's own estimates, from1995-2000 oil pipelines spilled an average of 0.9 gallons/million barrel-miles of oil, compared to 1.5for trucks, 0.7 for rail and 0.7 for barges. (10) Similar direct comparisons for gas pipelines are notavailable.

Accidental pipeline releases result from a variety of causes, including outside force (e.g., third-party excavation), corrosion, mechanical failure, control system failure and operator error. Natural forces, such as floods and earthquakes, can also damage pipelines. According to the DOT,of 183 gas pipeline accidents reported in 2002, outside forces were by far the leading cause,accounting for 46% of reported failures. Outside forces was also the leading cause of the 140 oilpipeline accidents in 2002, responsible for 32% of failures. (11) These accident figures are significantin the context of security for two reasons: such releases happen much more frequently than is likelyto occur from limited terrorist activity in the United States; and the pipeline industry has extensiveexperience responding to releases and generally does so relatively quickly.

Although pipeline releases have caused relatively few fatalities in absolute numbers, a single pipeline accident can be catastrophic. For example, a 1999 gasoline pipeline explosion inBellingham, Washington killed two children and an 18-year-old man, and caused $45 million indamage to a city water plant and other property. In 2000, a natural gas pipeline explosion nearCarlsbad, New Mexico killed 12 campers, including 4 children. (12) These accidents generatedsubstantial scrutiny of pipeline regulation and increased state and community activism related topipeline safety. (13) The accidents also highlightedthe danger of pipelines as possible terror weaponsbecause of their potential to harm people and damage property in their vicinity.

Pipeline Security Risks

Like any physical system, pipelines are vulnerable to vandalism and terrorist attack. The physical plant of these facilities may be damaged with explosives or by other mechanical means,disrupting flows and causing a release of pipeline contents. Alternatively, computer control systemsmay be "cyber-attacked," or both physical and cyber attack may happen at the same time. Somepipelines may also be indirectly disrupted by other types of terror strikes, such as attacks on regionalelectricity grids or telecommunications networks, which could in turn affect dependent pipelinecontrol and safety systems. (14) Since pipelinessupply fuel for vehicles, power plants, aircraft, heating,military bases and other uses, serious disruption of a pipeline network poses additional"downstream" risks.

Oil and gas pipelines have been a favored target of terrorists outside the United States. In Colombia, for example, rebels have bombed Occidental Petroleum's CaÃ±o LimÃ³n pipeline some 950times since 1986, shutting it for months at a time and costing Colombia's government some $2.5billion in lost revenues. (15) One of these attacksin 1998 caused a fire that killed or injured over 100people. (16) In 1996, London police foiled a plotby the Irish Republican Army to bomb gas pipelinesand other utilities across the city with 36 explosive devices. (17) In the last 2 years, oil and gaspipelines have also been attacked in Nigeria, Pakistan, Sudan, Myanmar and Iraq. In Saudi Arabia,a planned pipeline attack by al-Qaeda sympathizers at the country's main oil terminal was thwartedin 2002. Although it was unclear whether the planners had the capability to fully execute the Saudiattack, had they been successful, they could have disrupted the movement of over 6% of the world'sdaily oil consumption. (18)

Attacks and threats against pipelines and related infrastructure have also occurred in the UnitedStates. In 1997, Texas police prevented the bombing of natural gas storage tanks at a processingplant by Ku Klux Klan members seeking to create a diversion for a robbery (to finance other terroristactions). (19) In 1999, Vancouver police arresteda man planning to blow up the trans-Alaska pipelinefor personal profit in oil futures. He was found with high explosives and timers for 14 bombs. (20) In2001, a vandal's attack with a high-powered rifle, also on the trans-Alaska pipeline, forced a two-dayshutdown and caused extensive economic and ecological damage. (21)

Federal warnings about Al Qaeda threats since September 11, 2001 have repeatedly mentioned energy infrastructure broadly, and pipelines specifically, as potential terror targets in the UnitedStates. (22) These warnings included the discoveryin late 2001 that computer hackers in the MiddleEast had infiltrated San Francisco area sites detailing information about local electricity systems,along with other critical infrastructure. (23) In Juneof 2003, U.S. intelligence agencies warned abouta possible al-Qaeda attack on energy facilities, including pipelines, in Houston. (24) To date, there havebeen no actual attacks on these sites, but operators remain alert.

Despite substantial private and public efforts to promote security, it is widely recognized that pipelines are inherently vulnerable. The fact that pipelines run largely underground reduces theirexposure to external threats, but required markings tell emergency responders, homeowners -- andterrorists -- where pipelines are located. Rather than trying to uniformly protect their entire systems,operators emphasize the security of especially vulnerable areas, such as river crossings, controlcenters, junctions, and storage tanks. They try to "harden" (i.e., to enhance the security of ) thesefacilities and ensure adequate surveillance and monitoring. Operators also modify emergency plansto incorporate new elements of terror response, such as managing a federal crime scene.

Pipeline Safety and Security Regulation

The Natural Gas Pipeline Safety Act of 1968 (P.L. 90-481) and the Hazardous Liquid PipelineAct of 1979 ( P.L. 96-129 ) are two of the key early acts that specify the federal role in pipeline safety. Under both statutes, the Transportation Secretary is given primary authority to regulate key aspectsof interstate pipeline safety: design, construction, operation and maintenance, and spill responseplanning. Pipeline safety regulations, some with security implications, are covered in Title 49 of theCode of Federal Regulations. (25) This title:

Authorizes DOT to inspect pipelines and enforce its regulations with fines, injunctions, and criminal penalties

Requires operators to report incidents, safety-related conditions and annualsummary data

Prescribes minimum pipeline safety requirements, including operatorqualifications for regulated functions

Imposes oil spill response plan requirements to reduce environmental impactof accidental discharges

Provides grants-in-aid to state pipeline safety compliance agencies that adoptdamage prevention programs

Requires operators to establish drug and alcohol programs.

DOT administers pipeline regulations through the Office of Pipeline Safety (OPS) within the Research and Special Programs Administration (RSPA). The OPS has approximately 150 staff,including 100 inspectors generally located outside of Washington, D.C. (26) The OPS safety programis funded primarily by user fees assessed on a per-mile basis on each regulated pipeline operator(49USC60107).

Among other security-related provisions of P.L. 96-129 and subsequent laws, the OPS requires general protection of "exposed" oil pipeline facilities from vandalism and unauthorized entry. (27) TheOPS also requires specified pipeline operators to establish written procedures for communicatingwith governmental response agencies and other public officials during emergencies. (28) Certainreleases from oil or gas pipelines must be reported to DOT's National Response Center. (29) The OPSpractices emergency response to oil spills with federal, state, and industry representatives. Thelessons learned from these exercises, as well as the formal and informal relationships establishedduring these drills, help prepare for releases in deliberate attacks.

Since 1997, the OPS has increasingly encouraged industry's implementation of "integrity management" programs on pipeline segments near "high consequence" areas. Integrity managementprovides for continual evaluation of pipeline condition; assessment of risks to the pipeline;inspection or testing; data analysis; and followup repair, as well as preventive or mitigative actions. High consequence areas include population centers, commercially navigable waters, andenvironmentally sensitive areas, such as drinking water supplies or ecological reserves. The integritymanagement approach directs priority resources to locations subject to the greatest consequencesrather than applying uniform treatment to the entire pipeline network. (30) Integrity management riskassessments could be interpreted to include security, but the regulation does not explicitly addressterrorism, and the OPS has provided "minimal" guidance to operators regarding terrorism risksexpected in their plans. (31) The OPS made integritymanagement programs mandatory for mostoperators with 500 or more miles of regulated oil pipeline as of March 31, 2001 (49CFR195).

Pipeline Safety Improvement Act of 2002

On December 12, 2002, President Bush signed into law the Pipeline Safety Improvement Actof 2002 ( P.L. 107-355 ). The act reauthorizes funding for the OPS through fiscal year 2006. It alsostrengthens federal pipeline safety programs, state oversight of pipeline operators, and publiceducation regarding pipeline safety. (32)

Among other safety provisions, P.L. 107-355 requires operators of regulated gas pipelines in high consequence areas to conduct risk analysis and implement integrity management programssimilar to those required for oil pipelines under 49CFR195. Integrity management, as a whole, isintended to focus primarily on safety, but certain elements may also have links to security, dependingupon interpretation and application. For example, the integrity management rule for oil pipelinesstates that "identifying the need for additional preventive and mitigative measures, an operator mustevaluate the likelihood of a pipeline release occurring and how a release could affect the highconsequence area. This determination must consider all relevant risk factors..." (49CFR195.452). Guidance for this rule also cites "security of throughput (effects on customers if there is failurerequiring shutdown)" as a risk factor for establishing assessment frequency. (33) As is the case for oilpipelines, the rule does not explicitly discuss risks from terror attacks. Nonetheless, assessment ofaccident risks near population centers could provide important data for related terror riskassessments. Likewise, system safety inspections could provide data useful for related securityinspections.

P.L. 107-355 also:

requires development of integrity management analysis and program standards by DOT within 12 months of enactment, and gas pipeline operator implementation within 24 monthsof enactment (Sec. 14),

requires baseline integrity assessments of all high consequence area gaspipelines within 10 years, with reinspections every 7 years thereafter (Sec.14),

authorizes DOT to order safety actions for pipelines with potential safetyproblems (Sec. 7) and increases violation penalties (Sec. 8).

The criminal provisions under 49USC60123 amended by P.L. 107-355 state that "a person knowingly and willfully damaging or destroying, or attempting to damage or destroy, an interstategas pipeline facility or interstate hazardous liquid pipeline facility shall be fined..., imprisoned fornot more than 15 years, or both." These provisions, originally intended to deter unsafe excavatorsand vandals from damaging pipes, could just as well apply to terrorists.

Pipeline operators have long been concerned about permitting and administrative barriers to emergency pipeline restoration efforts. (34) The actattempts to streamline this process by establishingan interagency committee, including the Department of Transportation, Environmental ProtectionAgency, Bureau of Land Management, Federal Energy Regulatory Commission, and other agencies,to ensure coordinated review and permitting of pipeline repairs (Sec. 16). In the event of a terrorattack, expedited review and permitting could speed restoration by allowing operators to begin workquickly and to bypass damaged facilities by rebuilding through adjacent property or other alternateroutes.

P.L. 107-355 authorizes $100 million for research and development in pipeline integrity, safety, and reliability (Sec. 12) including "the real-time surveillance of pipeline rights-of-way, developingtools for evaluating and enhancing pipeline security and infrastructure, reducing natural,technological, and terrorist threats, and protecting first response units and persons near an incident"(Sec. 12c5).

The act requires DOT to study ways to limit pipeline safety risks from population encroachment and ways to preserve environmental resources in pipeline rights-of-way (Sec. 11). P.L. 107-355 alsoincludes provisions for public education, grants for community pipeline safety studies, "whistleblower" and other employee protection, employee qualification programs, mapping data submissionand other provisions.

Integrity Management Support by the OPS

The provisions of P.L. 107-355 place significant new demands on the OPS. The act requires gas pipeline operators with facilities in "high consequence" areas to adopt new integrity managementprogram plans by 2005, and to begin pipeline integrity assessments by mid-2006 (Sec 14.2). Thesegas pipeline plans will be in addition to oil pipeline integrity management plans required by49CFR195. The act states that OPS "shall review a risk analysis and integrity managementplan...and record the results of that review for use in the next review of an operator's program" (Sec14.9A). According to the General Accounting Office (GAO), a comprehensive review of an integritymanagement plan by the OPS took about 2 weeks per plan in 2002. (35) Reviewing new integritymanagement plans in a timely manner, while sustaining its traditional pipeline safety oversight, willstretch the OPS' resources. GAO notes that "inspectors will face difficulties in judging the adequacyof complex integrity management processes that will vary from company to company." (36)

The OPS' enabling legislation allows the agency to delegate authority to intra state pipeline safety offices, and allows state offices to act as "agents"administering inter state pipeline safetyprograms (excluding enforcement) for those sections of inter state pipelines within their boundaries. (37) When effectively utilized, state inspectors are valuable resources for the OPS because they arefamiliar with local pipeline operations and can increase inspection thoroughness and frequency overwhat the OPS could do alone. In 2002, around 400 state pipeline safety inspectors (in 48 states, theDistrict of Columbia and Puerto Rico) were available. (38) The OPS plans to rely heavily on its statepartners to inspect the integrity management programs of the intra state oil and gas pipelines. Butthe OPS must still administer a state's written assessments and related safety proposals (Sec 14.10).The agency faces additional challenges ensuring that state resources will be sufficient, training stateinspectors in integrity management, and ensuring consistency among numerous state offices. (39)

The OPS intends to hire more federal inspectors to help meet the regulatory obligations of the integrity management rules. The President's FY2005 budget request for the OPS seeks $13 millionfor 168 full-time equivalent (FTE) employees, compared to an estimated $13 million for 156 FTE'sin FY2004, and $10 million for 111 FTE's in FY2002. The budget also seeks $15 million inFY2005 for contract services, the same as in FY2004, but up from $5 million in FY2003. (40)

Pipeline Security Responses to September 11

Pipeline operators have always sought to secure their systems. While their security programstraditionally tended to focus on personnel safety and preventing vandalism, some have been morecomprehensive. For example, security at the trans-Alaska pipeline during the Gulf War includedmeasures such as armed guards, controlled access, intrusion detection and dedicated communicationsat key facilities, as well as aerial and ground surveillance of the pipeline corridor. (41) However, theevents of September 11, 2001 focused attention on the vulnerability of pipelines to different terroristthreats. In particular, the terrorist attacks raised the possibility of systematic attacks on pipelines bysophisticated terror groups in a manner that had not been widely anticipated before.

After the September 11 attacks, natural gas pipeline operators immediately increased security and began identifying additional ways to deal with terrorist threats. Gas pipeline operators, forexample, through the Interstate Natural Gas Association of America (INGAA), formed a securitytask force to coordinate and oversee the industry's security efforts. The INGAA states that it ensuredthat every member company designated a senior manager to be responsible for security. Workingwith DOT, the Department of Energy (DOE), and non-member pipeline operators, the INGAA states that it assessed industry security programs and began developing common risk-based practices forincident deterrence, preparation, detection and recovery. These assessments addressed issues suchas spare parts exchange, critical parts inventory systems, and security communications withemergency agencies, among other matters. The INGAA also worked with federal agencies,including the OPS and Homeland Security, to develop a common government threat notificationsystem. (42)

The natural gas companies reported significant commitments to bolster security at their critical facilities. According to the American Gas Association (AGA), companies strengthened emergency,contingency and business continuity plans; increased liaison with law enforcement; increasedmonitoring of visitors and vehicles on pipeline property; monitored pipeline flows and pressure ona continuous basis; increased employee awareness to security concerns; and deployed additionalsecurity personnel. (43) The industry also begandeveloping encryption protocol standards to protectgas systems from cyber attack. (44) Operators alsosought redundancy in the delivery system to providegreater flexibility to redirect or shut down product flows.

The oil pipeline industry responded to the September 11 attacks in a manner similar to that of the gas pipeline industry. Pipeline operators reviewed procedures, tightened security, reroutedtransportation patterns, closely monitored visitors and made capital improvements to harden keyfacilities. (45) Operators also increased surveillanceof pipelines, conducted more thorough employeebackground checks, and further restricted Internet mapping systems. (46) The Association of Oil PipeLines (AOPL) and the American Petroleum Institute (API), working together, provided guidance tomember companies on how to develop a recommended pipeline security protocol analogous to anexisting protocol on managing pipeline integrity. Along with the gas pipeline industry, the oilpipeline industry reconciled its levels of security threat and associated measures with the nationalthreat advisory system of the Office of Homeland Security. According to the AOPL, 95 percent ofoil pipeline operators had developed new security plans and had instituted the appropriate securityprocedures by February, 2003. The remaining 5 percent are primarily small operators in otherbusinesses but with oil pipelines between plant facilities. (47)

In conjunction with the Office of Homeland Security, pipeline operators joined with other gas and oil companies to establish an Information Sharing and Analysis Center (ISAC) in November2001. The ISAC is a cooperative, industry-directed database and software applications center forinformation related to security, including real-time threat alerts, cyber alerts and solutions. TheISAC allows authorized individuals to submit reports about information and physical securitythreats, vulnerabilities, incidents, and mitigation. The ISAC also provides access to information fromother members, U.S. government and law enforcement agencies,

technology providers, and other security associations. (48) In 2003, the ISAC had limited participationby operators since members were required to pay fees and similar information was available directlyfrom other sources. The energy industry has taken steps, such as hiring a new administrationcontractor, to increase the usefulness of the ISAC and increase its membership. (49)

Response of the Office of Pipeline Safety

Presidential Decision Directive 63 (PDD-63) issued during the Clinton administration assignedlead responsibility for pipeline infrastructure protection to the DOT. (50) At the time, theseresponsibilities fell to the OPS, since the agency was already addressing some elements of pipelinesecurity in its role as safety regulator. Immediately after September 11, 2001, the OPS issued severalemergency bulletins to oil and gas pipeline companies communicating the need for a heightenedstate of alert in the industry. According to a DOT official,

OPS personnel made immediate and individual telephone contact with all major pipeline operators to ensure that communication was open andviable between our offices and that they understood and adhered to the security issues. Additionally,OPS personnel contacted all of the state pipeline safety programs to provide them with securityinformation. (51)

Soon thereafter, because of national security concerns, the OPS removed from its web site detailed maps of the country's pipeline infrastructure.

The OPS also conducted a vulnerability assessment used to identify which pipeline facilities were "most critical" because of their importance to meeting national energy demands or proximityto highly populated or environmentally sensitive areas. The OPS worked with industry groups andstate pipeline safety organizations "... to assess the industry's readiness to prepare for, withstand andrespond to a terrorist attack..." (52) The OPS warnedthat critical pipeline facilities, such as controlcenters, pump and compressor stations, and storage facilities, might be targets -- and that many ofthese facilities needed to be better protected. (53)

Through 2002, The OPS was the federal agency most active in encouraging industry activities intended to better secure the nation's pipelines. In general, The OPS' approach was to encourageoperators to voluntarily improve their security practices rather than to develop new securityregulations. In adopting this approach, The OPS sought to speed adoption of security measures byindustry and avoid the publication of sensitive security information (e.g., critical facility lists) thatwould normally be required in public rulemaking. (54)

The OPS worked with several industry security task groups to define different levels of "criticality," to identify actions to strengthen protection based on this criticality, and to develop plansfor improved response preparedness. The OPS surveyed many pipeline companies to assess securitymeasures taken since 9/11. Together with DOE and state pipeline agencies, the OPS promoted thedevelopment of consensus standards for security measures tiered to correspond with the five levelsof threat warnings issued by the Office of Homeland Security. (55) The OPS also developed protocolsfor inspections of critical facilities to ensure that operators implemented appropriate securitypractices. To convey emergency information and warnings, the OPS established a variety ofcommunication links to key staff at the most critical pipeline facilities throughout the country. TheOPS also began identifying near-term technology to enhance deterrence, detection, response andrecovery, and began seeking to advance public and private sector planning for response andrecovery. (56)

On September 5, 2002, The OPS circulated formal guidance defining the agency's security program recommendations and implementation expectations. This guidance recommended thatoperators identify critical facilities, develop security plans consistent with prior trade associationsecurity guidance, implement security plans and review those plans annually. (57) The guidance definedasset "criticality" in terms of threats, risks to people, and economic impacts from the loss of energysupply. It also suggested specific security measures to be taken at the 5 different homeland securitythreat levels, with over 50 cumulative measures at the highest threat level. While the guidance wasvoluntary, the OPS expected compliance from operators of critical facilities. The agency believedit had the authority to enforce the requirements if voluntary compliance was not effective. The OPSasked operators for a written statement certifying their compliance within 6 months. The OPS alsoinformed operators of its intent to begin reviewing security programs within 6 months of thecertification deadline, potentially as part of more comprehensive safety inspections. (58)

Transportation Security Administration

In November, 2001, President Bush signed the Aviation and Transportation Security Act ( P.L.107-71 ) establishing the Transportation Security Administration (TSA) within DOT. The actaccorded TSA with responsibility for security "in all modes of transportation, including "...modesof transportation that are exercised by the Department of Transportation." According to TSA, thisprovision placed DOT's pipeline security authority (under Presidential Decision Directive 63)within TSA. The act specified for TSA a range of duties and powers related to general transportationsecurity, such as intelligence management, threat assessment, mitigation, security measure oversightand enforcement, among others. Due to high public concern about aviation, however, andaviation-related deadlines specified in the act, TSA focused primarily on aviation security during itsfirst year of existence. (59)

On November 25, 2002, President Bush signed the Homeland Security Act of 2002 ( P.L. 107-296 ) creating the Department of Homeland Security (DHS). Among other provisions, the acttransferred to DHS the Transportation Security Administration from DOT (Sec. 403). During 2003,TSA increased its focus on transportation modes beyond aviation. According to TSA officials, theagency took the lead as the national transportation security manager for pipeline security, buildingupon prior federal efforts and relationships (particularly those with the OPS) to do what it could "toprotect the critical infrastructure from terrorists." (60) These efforts were led by the Pipelines Branchin TSA's Transportation Infrastructure Security division.

On December 17, 2003, President Bush issued Homeland Security Presidential Directive 7 (HSPD-7) clarifying executive agency responsibilities for identifying, prioritizing and protectingcritical infrastructure. HSPD-7 maintains DHS as the lead agency for pipeline security (Par. 15),and instructs DOT to "collaborate in regulating the transportation of hazardous materials by allmodes (including pipelines)" (Par. 22h). The order also requires that DHS and other federalagencies collaborate with "appropriate private sector entities" in sharing information and protectingcritical infrastructure (Par. 25). HSPD-7 supersedes PDD-63 (Par. 37).

TSA Pipelines Branch Activities

TSA's Pipeline Branch is implementing its plans with respect to pipeline security inspections, standards development, and critical asset analysis. According to TSA, the agency expects pipelineoperators to maintain security plans based on the OPS/industry consensus security guidancecirculated in 2002 and subsequent revisions. (61) In 2003 the agency visited 24 of the largest 25-30pipeline operators to review their security plans and inspect their facilities. The agency plans tocomplete the remaining large operator inspections by April 2004, and then begin inspections ofmajor gas distribution systems. During the reviews, TSA evaluates whether each company hasfollowed the intent of the OPS/industry security guidance, and seeks to collect the list of assets eachcompany has identified meeting the criteria established for critical facilities. According to TSA,nearly all operators visited by the agency have met the minimum security guidelines, and some havegone "way beyond" the minimum requirements. All but two of the 24 operators have provided TSAwith copies of their security plans and system maps, as well as critical infrastructure information. The two operators declining to provide this information did not believe they had adequate assurancesthe information would be protected from public disclosure. The OPS joined TSA on approximatelyone-third of its operator inspections in 2003. (62) TSA seeks the OPS' participation in these reviews,but does not require it. (63)

TSA's FY2005 budget justification maintains that the agency "will... issue regulations where appropriate to improve the security of the [non-aviation transportation] modes." (64) Accordingly,TSA ultimately intends to establish pipeline security regulations to move beyond voluntarycompliance, as is now the case, and provide a clear basis for future enforcement. The agencybelieves such regulations may be necessary because it believes existing OPS safety regulationsprovide only limited enforcement authority in security, especially counter-terrorism. TSA has begunthe process of developing new pipeline security regulations, but it is not clear when TSA willactually issue them. TSA believes it has the OPS' agreement that future TSA security plans will bethe only ones required of operators and that TSA will be responsible for reviewing them. (65)

According to TSA, the agency intends to work with industry to help operators better identifytheir most critical assets. Industry has been assessing asset criticality under the current securityguidance, but TSA plans to publish a new multi-modal (including pipelines) model providing aclearer basis for identifying assets that might be subject to terrorist attacks. The model accounts forpotential loss of human life and well-being (e.g., illness, access to emergency services),reconstitution, economic impact, and symbolic importance. TSA expects assessments to beconducted initially within each transportation mode, with final assessments across all transportationmodes. TSA intends to use the model results for allocating resources to protect the highest priorityassets across different modes of transportation. TSA's Pipeline Branch has been developing, andplans to maintain in the future, its own inventory of critical pipeline infrastructure based on thismodel. (66)

The TSA has also been developing a new multi-modal asset vulnerability tool, the Transportation Risk Assessment and Vulnerability Evaluation (TRAVEL) model, which it expectsthe major transportation modes (including pipelines) to use for evaluating the vulnerability of criticalassets. According to TSA staff, the model should evaluate operator security plans based on a set ofpre-determined relevant and realistic "attack scenarios." For pipelines, these scenarios specify avariety of physical and cyber-attacks to the network, including attacks incorporating chemical andbiological agents. By applying one model across transportation modes, TSA seeks to establish amore consistent approach to assessing vulnerability than mode-specific models might provide. (67) According to TSA, the TRAVEL model has not yet been finalized and expanded to includepipelines, although it has already been used in other transportation modes. (68)

In addition to the activities above, TSA intends to establish qualifications for personnel seeking unrestricted access to critical transportation assets, including pipeline assets. TSA has also beenaddressing legal issues regarding recovery from terrorist attacks, such as FBI control of crime scenesand eminent domain or property seizure in pipeline restoration around a crime scene. (69)

Key Policy Issues in Pipeline Security

Government and industry have taken substantial actions during the last two years to improvepipeline security and oversight. As one industry executive remarked, "Before 9/11, we nevercontemplated somebody flying a jet into some critical facility we have. Now we not only think aboutit, but we're also putting very different contingency plans in place." (70) Federal agencies acknowledgeindustry's progress. The President's 2003 infrastructure protection strategy, for example, noted that"pipeline facilities already incorporate a variety of stringent safety precautions" and that "as a whole,the response and recovery capabilities of the pipeline industry are well proven..." (71) Senior DHSofficials have also asserted that "pipelines are the best organized and have the best security practices"among maritime and land transportation sectors. (72)

Notwithstanding the progress to date in improving pipeline security, continued implementation of industry and government programs faces several challenges. As discussed in detail in thefollowing sections, many in industry are concerned about the quality of information about actualterrorism threats that they receive from DHS. Industry is also generally concerned that criteria foridentifying critical facilities continue to evolve. As a result, the pipeline industry is concerned thatit may be forced to spend too much on pipeline security, or spend in the wrong places -- divertinglimited resources from safety programs and other important uses. TSA faces resource constraintsof its own, limiting the agency's ability to improve industry security standards and oversee pipelinesecurity in the field. TSA and the OPS currently cooperate on security inspections, but many inindustry are still concerned about the possibility of redundant, conflicting regulatory regimes.

Federal Threat Information

The DHS' Homeland Security Advisory System communicates terrorist threats to the public based on five threat conditions: low, guarded, elevated, high and severe (represented by the colorsgreen, blue, yellow, orange and red). (73) Thepipeline industry's security guidance links specificsecurity measures to these five threat levels. While this approach ensures some consistency in terrorpreparedness among pipeline systems, many operators believe they require more specific threatinformation to make better security decisions and focus protection where it is truly needed. Forexample, these operators question whether an "orange" DHS threat level applies equally across thecountry. (74) By uniformly responding to what theyperceive as ambiguous warnings, operators believethey may expend scarce resources to bolster security at facilities that are not really under increasedthreat. Furthermore, operators do not believe federal agencies have been as effective as they couldbe communicating the specific threat information they do receive. According to one industryrepresentative, "CNN tells us first, then we hear from FBI, DOE and other agencies." (75)

Concerns about non-specific threat information are not endemic to pipelines, however, and they are not new. DHS Secretary Ridge has acknowledged that the current color-coded terror alert systemneeds improvement to provide greater "granularity." He expressed the department's intention tocreate a system that could raise threats for specific industries or geographic areas without changingthreat levels elsewhere. However, Secretary Ridge also commented that information on terroristmovements was still too vague for such specific warnings. (76)

Identifying Critical Facilities

Various industry representatives state that they need clear and stable definitions of pipeline asset criticality so they will know exactly what assets to protect, and how well to protect them. Otherwise,the pipeline industry risks hardening too many facilities, hardening the wrong facilities, or both. Either outcome would increase ultimate costs to consumers without commensurate security benefits,and could potentially divert scarce security resources from better uses within or outside the pipelineindustry (e.g., securing electric power stations).

Despite the security guidance put forward by the OPS in 2002, pipeline operators are still uncertain how regulators will ultimately identify critical facilities -- and what protections regulatorswill expect for them. The definition of criticality developed by industry in 2002 (and supported inthe OPS' guidance) avoided numerical thresholds, relying instead on discretionary qualitativemetrics like "significance" of impact. (77) The OPShas expressed its belief that this criticalitydefinition may be too general and that clearer criticality thresholds are needed. (78) The HSPD-7directive appears to narrow the definition of "criticality" by emphasizing "infrastructure and keyresources that could be exploited to cause catastrophic health effects or mass casualties" (Par. 13). It is not clear, however, how this emphasis will change what is considered to be critical pipelineinfrastructure.

The pipeline industry is also concerned that, in its efforts to ensure consistency among transportation modes, TSA will not appropriately treat pipeline assets as unique (non-vehicular)transportation and a key component in the nation's broader energy infrastructure. (79) For example,many are concerned that threshold parameters such as "fair market value of lost asset" in TSA'smodel might not appropriately account for the downstream economic impact of disrupted gas or oilsupplies. (80)

Pipeline Security Resources at TSA

The President's FY2005 budget request for DHS does not include a separate line item forTSA's pipeline security activities. The budget request does include a $146 million line item for"Transportation Security Enterprise," which encompasses all security activities in non-aviationtransportation modes, including pipelines. (81) According to TSA's budget office, the Pipelines Branchreceives from the agency's general operational budget "a normal allocation for routine operations"such as regulation development, travel, and outreach. (82) According to TSA's pipeline branch, thecurrent budget will fund five full-time staff, the same staff level as in FY2004. These staff willmaintain TSA's asset database, support TSA's multi-modal risk models, develop new securitystandards and issue regulations -- all with the consultation of industry and other federal agencies. In addition, TSA staff will conduct pipeline security inspections and enforce any future securityregulations. (83)

At its current staffing level, TSA's Pipelines Branch has limited field presence for inspections and possible enforcement of future regulations, an issue of particular concern to TSA. (84) (Forcomparison, the OPS can deploy around 500 federal and state safety inspectors across the samepipeline network.) According to TSA, the agency cannot now use OPS inspectors extensively forsecurity work because the OPS faces resource constraints of its own; only a handful of OPSinspectors are trained in security; and even if the OPS could "lend" inspectors to TSA, the agencywould require compensation TSA cannot currently offer. (85) Furthermore, it is not clear that TSA hasa mechanism under law to delegate inspection authority to state agencies like the OPS does. Evenif TSA did have such a mechanism, states appear generally unwilling to take on this responsibility,lack the required security inspection skills, and might not be able to adequately safeguard securityinformation. (86) The TSA is reluctant to usecontractors for field work because the pipeline industryis concerned about safeguarding security information. (87)

TSA's plan to focus security inspections, at least initially, on the largest pipeline anddistribution system operators seeks to make the best use of limited staff. It is an open question,however, how many of the remaining operators -- some 1,000 systems -- should also be inspected. Criticality assessment and risk analysis are still evolving, so the basis for prioritizing one set ofpipelines over another for security purposes is debatable. For example, while possibly less criticalfrom a national perspective, smaller pipeline systems still present local security risks, and couldarguably be more vulnerable than larger systems if they have smaller security budgets and fewer staffdedicated to infrastructure protection. Without security plan verification and a credible threat ofenforcement, operator compliance with security guidance may be inadequate, leaving the pipelinenetwork as a whole less secure than it might be with more universal inspection and enforcementcoverage.

OPS and TSA Cooperation on Pipeline Security

The relationship between the OPS and TSA on pipeline security matters is still evolving, butappears to be generally cooperative. While TSA believes it has an understanding with the OPS thatTSA will be the lead agency for pipeline security, a memorandum of agreement between the agencieshas not been signed. According to agency correspondence, when DHS was created, TransportationSecretary Mineta did not believe that a formal agreement between TSA and the OPS would benecessary because the two agencies were already working together. (88)

The OPS sees a strong link between pipeline security and safety. One senior agency administrator has asserted that "safety and security are interdependent...the distinction is a functionof intent to do damage." (89) In the context of itsongoing safety activities, the OPS maintains that"pipeline integrity is a broad umbrella covering safety, security and reliability." (90) Nonetheless, theOPS acknowledges TSA's superior access to information on threats and vulnerabilities, as well asTSA's broader multi-sector perspective. Accordingly, OPS staff believe that while the OPS willnot be the major player in pipeline security, the agency will always have a role. In particular,according to the OPS, the agency plans to ensure that pipeline security measures do not adverselyimpact pipeline safety. (91) In the short term, theOPS plans to independently conduct security spill andresponse exercises and, with TSA, to jointly inspect operator security plans based on its securityguidance of last year. (92) The OPS has not,however, made a long-term commitment to securityinspections, currently using only minimal resources in the form of a few staff working part-time withTSA.

The pipeline industry is generally concerned that it might face redundant, conflicting regulatory regimes under different agencies with "teams from government stumbling over each other to inspectpipes." (93) Consequently, TSA believes a sharperdistinction ultimately may be needed between itssecurity activities, and the safety activities of the OPS. TSA is concerned that too much OPSinvolvement in pipeline security may create confusion among operators as to which agency is incharge of security and what requirements may be in force. The OPS and TSA believe theirresponsibilities have been worked out, however, without the need for formal agreements. Theagencies are engaged in ongoing roundtable discussions with the pipeline trade associations andFERC to address additional concerns as they emerge. (94)

The Pipeline Security Challenge in Perspective

U.S. pipeline operators currently report no specific threats to their networks -- but the nation's's pipeline system is extensive and presents an inviting target. It is widely accepted thatprotecting their assets better is in the best interest of operators, and federal agencies are monitoringand encouraging these efforts. As a practical matter, industry and government could spend vast sumsto enhance pipeline security -- but this investment would have to be balanced against many otherinvestment needs and opportunities. The OPS and TSA face resource limitations and have manyother priorities besides pipeline security concerns. Furthermore, it is widely held that pipelines arealready safer and more secure than most other critical infrastructures. While the pipeline industrycontinues to face challenges protecting its assets, many analysts believe that more urgent securitychallenges lie elsewhere.

Conclusions

Both government and industry have taken numerous steps to try to improve pipeline security. Federal activities in this area are relatively new and agency responsibilities are still being sorted out,but discussions with a variety of industry representatives suggest that these efforts are generallythought to be moving in a logical direction. Furthermore, ongoing dialogue among the operators andfederal agencies appears to be addressing many elements of federal pipeline security policy that havebeen causing concern.

As oversight of the federal role in pipeline security continues, questions may be raised concerning the existing resources of TSA and its ability to execute its various pipeline securityresponsibilities, especially the implementation and enforcement of any potential future pipelinesecurity regulations. Congressional policymakers may pose questions: Are TSA's pipeline securityactivities adequately funded? Is there a solid basis for how TSA prioritizes the most "critical"pipeline systems so that important network security vulnerabilities are not overlooked? Should TSAinspect more pipeline systems to ensure universal compliance with security guidelines? Is there anappropriate division of responsibility for pipeline security among the federal agencies to minimizethe possibility of regulatory confusion and best balance agency missions with capabilities?

In addition to these specific issues, Congress may wish to assess how the various elements of U.S. pipeline security activity fit together in the nation's overall strategy to protect criticalinfrastructure. For example, increasing the number of pipeline security inspections by TSA couldbe of limited value if asset "criticality" is not clearly defined and federal threat information remainsambiguous. Likewise, diverting pipeline resources away from safety to enhance security mightfurther reduce terror risk, but not overall pipeline risk, if safety programs become less effective asa result. U.S. pipeline security necessarily involves many groups: federal agencies, oil and gaspipeline associations, large and small pipeline operators, and critical and non-critical asset owners. Reviewing how these groups work together to achieve common security goals could be an oversightchallenge for Congress.

Appendix: Pipeline Security Activities of Other Federal Agencies

Federal Infrastructure Security Agencies

The Critical Infrastructure Assurance Office (CIAO), created by PDD-63 as an interagency office within the Commerce Department in 1998, was charged with coordinating federal criticalinfrastructure assurance initiatives and raising industry awareness of infrastructure risks, especiallythose related to information systems. (95) Amongother activities, CIAO facilitated private sector(including oil and gas) input to the national strategy for critical infrastructure through the Partnershipfor Critical Infrastructure Security, and helped support formation of the Energy Information Sharingand Analysis Center (ISAC). (96)

The National Infrastructure Protection Center (NIPC) within the FBI was also created by PDD-63 in 1998. The mission of the NIPC was to detect, prevent, respond to and investigatemalicious acts against the nation's critical infrastructures. NIPC was a primary source of threatinformation to the Energy ISAC, and also worked with industry on national critical infrastructurestrategy. The NIPC was viewed by industry as "a central focus for law enforcement and incidentanalysis, but not the central point for all forms of private sector cooperation." (97)

The Office of Energy Assurance (OEA) was established within the Department of Energy by Secretary Abraham in May, 2001 to help protect the country against major energy supply disruptions. While the DOE is not responsible for pipeline security, its activities under PDD-63 as the leadagency for all other energy security has had implications for oil and gas pipelines. For example,OEA co-sponsored the development of guidelines for municipal governments to respond to naturalgas supply disruptions. (98) The OEA's NationalInfrastructure Simulation and Analysis Center(NISAC) was chartered under Section 1016 of the USA Patriot Act ( P.L. 107-56 ) in October, 2001. The NISACs's stated mission has been to provide new computer modeling and simulationcapabilities for critical infrastructure analysis focusing on interdependencies, vulnerabilities, andcomplexities. (99) NISAC has promoted, amongother capabilities, the ability to assess the propagationand escalation of minor initiating events between energy, communication and waterinfrastructures. (100)

The Homeland Security Act of 2002 transferred the activities of the Critical Infrastructure Assurance Office, the National Infrastructure Protection Center, and the Office of Energy Assurance(Sec. 201) into the new Information Analysis and Infrastructure Protection (IAIP) Directorate ofDHS. The stated mission of IAIP is to "analyze intelligence and information from other agencies(including the CIA, FBI, DIA and NSA) involving threats to homeland security and evaluatevulnerabilities in the nation's infrastructure." (101) Among other activities, IAIP intends to evaluatecross-infrastructure (e.g., energy, transportation and telecom) dependencies from the broadestperspective, building on criticality and vulnerability analysis done by the separate infrastructuresector lead agencies -- such as TSA for pipelines. IAIP also intends to offer guidance on "protectionaction strategies" with the overall goal of "enabling protection with better information." IAIP alsointends to dedicate "technical experts" to facilitate analysis done by the infrastructure sector leadersand their industry partners, but will not seek direct regulatory relationships with industry unlesssector lead agencies fail to do so. (102)

Department of Justice

In addition to greater oversight of pipelines by regulatory agencies, the Department ofJustice(DOJ) has increased its enforcement activities related to pipelines. For example, on January 22,2003, the Justice Department, with the Environmental Protection Agency and the state ofWashington, announced a settlement with Olympic Pipeline Co. and Shell Pipeline Co., resolvingclaims from the Bellingham pipeline accident. That settlement imposed some $92 million in civilfines and enhanced spill prevention spending, on top of $21 million in penalties imposed in relatedcriminal proceedings. (103)

On March 11, 2003, emphasizing the environmental aspects of homeland security, Attorney General Ashcroft announced a crack down on companies failing to protect against possible terroristattacks on storage tanks, transportation networks, industrial plants -- and pipelines. He pledged toincrease prosecution of civil and criminal cases, where appropriate, to make companies comply withenvironmental and safety laws. (104) Along withother requirements, he asserted the department'sintention to enforce laws that "call for facilities to develop emergency response plans" and that "assure that pipelines do not leak or explode." (105)

The Justice Department has not initiated any new pipeline cases since March. However, on April 1, 2003, DOJ and EPA did announce a $34 million civil penalty -- the largest in EPA history-- to Colonial Pipeline for seven recent oil spills. Along with other safety provisions, the penaltysettlement requires Colonial to treat its entire 5,500 mile network as "high consequence" under OPSrules. (106) While there are currently fewsecurity-specific regulations in the federal code, high profilepipeline safety settlements do have security connections as noted earlier in this report. Moreover,they indicate DOJ's future willingness to enforce new security regulations that may arise from recentlegislation.

Federal Energy Regulatory Commission

One area related to pipeline safety not under the OPS's primary jurisdiction is the siting approval of new gas pipelines, which is the responsibility of the Federal Energy RegulatoryCommission (FERC). FERC's primary role is regulating prices for the transmission and sale ofwholesale oil and natural gas in interstate commerce. But companies building interstate gas pipelinesmust first obtain from FERC certificates of public convenience and necessity. (FERC does notoversee oil pipeline construction.) FERC must also approve the abandonment of gas facility use andservices. These approvals may include safety and security provisions with respect to pipelinerouting, safety standards and other factors. (107) As a practical matter, however, FERC has traditionallyleft these considerations to the OPS. (108)

On September 14, 2001, the Federal Energy Regulatory Commission (FERC) notified FERCregulated companies that it would "approve applications proposing the recovery of prudentlyincurred costs necessary to further safeguard the nation's energy systems and infrastructure" inresponse to the terror attacks of 9/11. FERC also committed to "expedite the processing on apriority basis of any application that would specifically recover such costs from wholesalecustomers." Companies could propose a surcharge over currently existing rates or some other costrecovery method. (109) According to FERC, 3pipeline operators have filed formal requests for securitycost recovery to date. Of these applications 2 were approved, 1 was withdrawn. (110)

On February 2003, FERC handed down a new rule (RM02-4-000) to protect critical energyinfrastructure information (CEII). The rule defines CEII as information that "must relate to criticalinfrastructure, be potentially useful to terrorists, and be exempt from disclosure under the Freedomof Information Act." According to the rule, critical infrastructure is "existing and proposed systemsand assets, whether physical or virtual, the incapacity or destruction of which would negatively affectsecurity, economic security, public health or safety, or any combination of those matters." CEIIexcludes "information that identifies the location of infrastructure." The rule also establishesprocedures for the public to request and obtain such critical information, and applies both toproposed and existing infrastructure. (111)

On May 14, 2003, FERC handed down new rules (RM03-4) facilitating the restoration of pipelines after a terrorist attack. The rules allow owners of a damaged pipeline to use blanketcertificate authority to immediately start rebuilding, regardless of project cost, even outside existingrights-of-way. Pipeline owners would still need to notify landowners and comply withenvironmental laws. Prior rules limited blanket authority to $17.5 million projects and 45-dayadvance notice. (112)

National Transportation Safety Board

Major pipeline incidents, like other transportation incidents, are investigated independently by the National Transportation Safety Board (NTSB). NTSB investigations would examine what causedan incident and whether it was accidental or deliberate. In this respect, NTSB could play a role interror incident investigations. Since 1969, NTSB has investigated over 100 natural gas and oilpipeline incidents. Based on the probable cause of an incident, NTSB may make recommendationsto prevent recurrences. NTSB may also conduct special studies of pipeline safety issues of nationalsignificance, and may evaluate the safety effectiveness of government agencies involved intransportation. For example, NTSB reviewed federal oversight of oil pipeline safety in 1996. (113) More recently, NTSB investigated both the Bellingham and Carlsbad pipeline accidents.