4 ms·

The tech audit was 3-4 years ago and colonial may or may not have heeded all the advice from the audit. They are claiming that they have followed at least some

by S_A_P 5y ago

The tech audit was 3-4 years ago and colonial may or may not have heeded all the advice from the audit. They are claiming that they have followed at least some of the recommendations and that the pipeline control system was air gapped and not affected by the ransomware.

fuzzfactor 5y ago
>Robert F. Smallwood, whose consulting firm delivered an 89-page report in January 2018 after a six-month audit. “I mean an eighth-grader could have hacked into that system.”
- hanniabu 5y ago
  Can't say I'm surprised. This is what 0 regulation and free market capitalism looks like. In theory they would secure their systems because a hack would be bad for business, but in reality with bribes, lobbying, and networking, once you have a contract you pretty much have it for good so there's no incentive to spend extra money on things like security, environmental safety, etc unless it's required.
  - djrogers 5y ago
    > This is what 0 regulation and free market capitalism looks like. Nope, that’s nothing like what this is. Oil pipelines are heavily regulated, with ZERO competition. As government protected monopolies, they’re the exact opposite of a free market.
    - hanniabu 5y ago
      I was exaggerating. Sure they're regulated, but "heavily" is also an overstatement compared to how much they should be regulated. This is no different than how when talking about installing a new pipeline they say there's all these fail-safes, protections, monitoring, inspections, etc, but then oil leaks happen and it's found that the pipe had been deteriorating for months if not years which shows they actually aren't under the scrutiny that's claimed and there aren't protections in place. Or they lobby to have their pipeline self-inspected similar to what Tyson was able to negotiate with their meat plants. That's just one example of many. Sure in theory there's all this regulation, but somehow we keep having disaster after disaster that would have been avoided if all these regulations were enforced.
      - indymike 5y ago
        > Sure in theory there's all this regulation, but somehow we keep having disaster after disaster that would have been avoided if all these regulations were enforced. Making new regulations is not helpful when the problem is the existing regulations are not enforced.
        a3n 5y ago
        But making new regulations that also won't be enforced is the easiest way to show that Congress and regulators are doing something. Following fiery hearings of course. "We've got to protect our phoney baloney jobs!"
  - mistrial9 5y ago
    outsider here, but I suspect the time and effort is put into controlling your debt and in-fighting among senior people; anything in operations is "blue collar" plus many leaders are older alcoholics who do not learn well by that stage of their career. They are not dumb, but something outside of their experience may never be questioned, or easily glossed over. They have people coming at them who want to sell legal or business services that will say anything the decision maker wants to hear, including actually wrong details, to close a contract and get paid. I will add to this comment that I am very, very concerned that incidents like this lead to changing the rules on communications for hundreds of millions of people. Why do others pay for your mistakes in guarding your wealth for yourself?
    - silexia 5y ago
      I agree, most of senior management at places like this are ageing country club members who know how to maintain their monopoly by wining and dining regulators, but are incompetent at running a business.
  - marcinzm 5y ago
    Because government agencies (ie: literally not free market capitalism) never get hit with ransomware... https://www.bbc.com/news/world-europe-57111615 https://www.bbc.com/news/world-europe-57111615 https://www.sungardas.com/en-us/blog/ransomware-attacks-on-us-government-entities/ https://www.sungardas.com/en-us/blog/ransomware-attacks-on-u... So yeah blame capitalism and not inherent human nature that applies to every large scale system built by humans.
- detaro 5y ago
  > said he prepared a 24-month, $1.3 million plan for Colonial. Sounds a bit cheap to fix such a thing.
  - fuzzfactor 5y ago
    I'm sure it would cost at least $5 million more now ;) Aging private infrastructure built by tycoons. Once the sizable venture capital is paid back the original shareholders rake in the bucks and money is no object when it comes to protecting their cash cow. But future generations of shareholders pay a premium market price based on the cash from the cow at the time, which can be quite a favorable investment, but nothing like the VC bonanza. Public, or private shareholders as in this case. The maintenance, modernization and dedication to integrity that the original shareholders could easily afford might still end up out-of-reach to future generations. But the business started out so good and "nothing changed" so it can be ignored. Where grandpa took great pride in spending millions per year maintaining the assets which is so much less than they were spending building the company, Thurston Howell III just has financial people looking at his numbers and couldn't build anything his own self anyway. Plus if it all does go "down the tubes" he'll still be fine regardless. Wear & tear plus obsolescence creeps in undetected until it rears its ugly head and they say "who knew?"

by S_A_P 5y ago

fuzzfactor 5y ago

>Robert F. Smallwood, whose consulting firm delivered an 89-page report in January 2018 after a six-month audit. “I mean an eighth-grader could have hacked into that system.”

hanniabu 5y ago
Can't say I'm surprised. This is what 0 regulation and free market capitalism looks like. In theory they would secure their systems because a hack would be bad for business, but in reality with bribes, lobbying, and networking, once you have a contract you pretty much have it for good so there's no incentive to spend extra money on things like security, environmental safety, etc unless it's required.
- djrogers 5y ago
  > This is what 0 regulation and free market capitalism looks like. Nope, that’s nothing like what this is. Oil pipelines are heavily regulated, with ZERO competition. As government protected monopolies, they’re the exact opposite of a free market.
  - hanniabu 5y ago
    I was exaggerating. Sure they're regulated, but "heavily" is also an overstatement compared to how much they should be regulated. This is no different than how when talking about installing a new pipeline they say there's all these fail-safes, protections, monitoring, inspections, etc, but then oil leaks happen and it's found that the pipe had been deteriorating for months if not years which shows they actually aren't under the scrutiny that's claimed and there aren't protections in place. Or they lobby to have their pipeline self-inspected similar to what Tyson was able to negotiate with their meat plants. That's just one example of many. Sure in theory there's all this regulation, but somehow we keep having disaster after disaster that would have been avoided if all these regulations were enforced.
    - indymike 5y ago
      > Sure in theory there's all this regulation, but somehow we keep having disaster after disaster that would have been avoided if all these regulations were enforced. Making new regulations is not helpful when the problem is the existing regulations are not enforced.
      - a3n 5y ago
        But making new regulations that also won't be enforced is the easiest way to show that Congress and regulators are doing something. Following fiery hearings of course. "We've got to protect our phoney baloney jobs!"
- mistrial9 5y ago
  outsider here, but I suspect the time and effort is put into controlling your debt and in-fighting among senior people; anything in operations is "blue collar" plus many leaders are older alcoholics who do not learn well by that stage of their career. They are not dumb, but something outside of their experience may never be questioned, or easily glossed over. They have people coming at them who want to sell legal or business services that will say anything the decision maker wants to hear, including actually wrong details, to close a contract and get paid. I will add to this comment that I am very, very concerned that incidents like this lead to changing the rules on communications for hundreds of millions of people. Why do others pay for your mistakes in guarding your wealth for yourself?
  - silexia 5y ago
    I agree, most of senior management at places like this are ageing country club members who know how to maintain their monopoly by wining and dining regulators, but are incompetent at running a business.
- marcinzm 5y ago
  Because government agencies (ie: literally not free market capitalism) never get hit with ransomware... https://www.bbc.com/news/world-europe-57111615 https://www.bbc.com/news/world-europe-57111615 https://www.sungardas.com/en-us/blog/ransomware-attacks-on-us-government-entities/ https://www.sungardas.com/en-us/blog/ransomware-attacks-on-u... So yeah blame capitalism and not inherent human nature that applies to every large scale system built by humans.
detaro 5y ago
> said he prepared a 24-month, $1.3 million plan for Colonial. Sounds a bit cheap to fix such a thing.
- fuzzfactor 5y ago
  I'm sure it would cost at least $5 million more now ;) Aging private infrastructure built by tycoons. Once the sizable venture capital is paid back the original shareholders rake in the bucks and money is no object when it comes to protecting their cash cow. But future generations of shareholders pay a premium market price based on the cash from the cow at the time, which can be quite a favorable investment, but nothing like the VC bonanza. Public, or private shareholders as in this case. The maintenance, modernization and dedication to integrity that the original shareholders could easily afford might still end up out-of-reach to future generations. But the business started out so good and "nothing changed" so it can be ignored. Where grandpa took great pride in spending millions per year maintaining the assets which is so much less than they were spending building the company, Thurston Howell III just has financial people looking at his numbers and couldn't build anything his own self anyway. Plus if it all does go "down the tubes" he'll still be fine regardless. Wear & tear plus obsolescence creeps in undetected until it rears its ugly head and they say "who knew?"