Colonial Pipeline CEO to testify on Capitol Hill in June following cyberattack

Colonial Pipeline CEO Joseph Blount will testify in June before the House Homeland Security Committee at a hearing one month after the company was forced to shut down operations due to a devastating ransomware attack. 

The hearing, which will take place June 9, will focus on the pipeline attack, which resulted in gas shortages in several U.S. states, as well as how to strengthen critical infrastructure. 

The pipeline provides around 45 percent of the East Coast’s fuel. Operations were disrupted after the ransomware attack on the company’s IT system forced the company to shut down the pipeline for almost a week to protect operational controls.

President Biden confirmed last week that the cyber criminals behind the attack were likely based in Russia, but not backed by the Russian government. 

House Homeland Security Committee Chairman Bennie Thompson (D-Miss.) said in a statement Thursday that the attack on Colonial Pipeline “laid bare” the three challenges of “cybersecurity vulnerabilities in critical infrastructure, the need to build resilience into our networks, and the profitability of ransomware.”

“To address these urgent challenges, Congress must have a complete understanding of what happened on Colonial Pipeline’s networks, how it made decisions related to network operations and ransom payments, and how it leveraged support from the Federal government and private sector,” Thompson said.

Blount will almost certainly face questions about Colonial Pipeline’s decision to pay the cyber attackers the equivalent of around $4.4 million in Bitcoin to regain access to IT systems. 

Blount told The Wall Street Journal on Wednesday he had authorized the sum to be paid on the day of the attack, describing it as a “highly controversial decision,” but the “right thing to do for the country.”

Rep. Jim Langevin (D-R.I.), a member of the committee and a member of the Cyberspace Solarium Commission, was critical of the decision, tweeting Wednesday that both paying the ransom and “freezing out” the FBI and the Cybersecurity and Infrastructure Security Agency was “not ‘good for the country.’ ”

“I’ll have some questions about Blount’s judgement when he appears before @HomelandDems in a couple weeks,” Langevin tweeted. 

Paying cyber criminals $4.4 million, while freezing out the @FBI and @CISAgov, is not “good for the country.”

I’ll have some questions about Blount’s judgement when he appears before @HomelandDems in a couple weeks.https://t.co/9P3VjFaakr

— Jim Langevin (@JimLangevin) May 19, 2021

The hearing comes after the House Homeland Security Committee participated in briefings this past week related to the attack on Colonial. These meetings included a staff-level briefing with the House Oversight and Reform Committee Tuesday, after which committee leaders blasted Colonial for refusing to confirm that it paid the ransom. 

“We’re disappointed that the company refused to share any specific information regarding the reported payment of ransom during today’s briefing,” Thompson and House Oversight and Reform Committee Chairwoman Carolyn Maloney (D-N.Y.) said in a joint statement Tuesday. “In order for Congress to legislate effectively on ransomware, we need this information.”

Thompson, whose committee has taken a series of bipartisan steps in the last week to prioritize cybersecurity and met with Colonial officials to discuss the June 9 hearing on Thursday, underscored the importance of strengthening cybersecurity of critical systems. 

“As we do our work to investigate what happened at Colonial Pipeline, we must not make the mistake of taking a siloed approach to addressing cybersecurity vulnerabilities in critical infrastructure,” Thompson said Thursday. “The reality is cyber attacks against critical infrastructure will have cross-sector impacts. Federal policy should be rooted in that reality, as it has been since September 11, 2001.”

“Moving forward, we will work to build a stronger understanding of cybersecurity vulnerabilities to critical infrastructure and the interdependencies among sectors to inform policies that will encourage mitigation and build resilience,” he added.