Colonial CEO Would Love if You Could Forget About His Company

The Colonial pipeline has proven just how critical of a piece of infrastructure it is after it was shut down by a ransomware attack last week that sparked a gasoline shortage along the East Coast. But the company doesn’t want you to remember just how important it is to daily life. There’s a good reason: Anonymity has allowed it to avoid accountability for decades.

In an interview with the Wall Street Journal published Wednesday, Joseph Blount, who’s been the CEO of the company since 2017, explained his reasoning behind the decision to pay the hackers a $4.4 million ransom (a move that most cybersecurity experts advise against). At the end of the interview, Blount confessed that he would much rather have no one pay attention to them at all.

“We were perfectly happy having no one know who Colonial Pipeline was, and unfortunately that’s not the case anymore,” Blount told the Journal. “Everybody in the world knows.”

Now, I’m no big business guy like Mr. Blount, but I feel like normally it’s a good thing to have more people know about your company and the essential services it provides. But for Colonial, anonymity has worked out just fine. The pipeline, which was built in the early 1960s and is privately owned by a group of companies, some of which are familiar names.

Its largest shareholder is Koch Industries, which made $85 million in dividends from the pipeline in 2016, while Royal Dutch Shell is also an owner. The company exists today more as a financial asset than a piece of infrastructure that grows and changes with the energy system; the pipeline quietly pumps out tens of millions of dollars for investors each year mostly by simply existing and generating huge profit margins for its owners. Bloomberg reported that the company made more than $421 million in profits last year, and returned more than 90% of that to investors.

This sort of explains some of the really embarrassing details that have come out about Colonial’s security in recent weeks, like how the company had been trying to hire a cybersecurity manager just a few weeks before the incident, or the fact that an expert the company tapped to do a security audit in 2018 said that “an eighth-grader” could have hacked the Colonial system. If a pipeline makes money for investors by simply just existing year after year with no real effort needed on their part to maintain profitability, why bother putting in the elbow grease needed to maintain the company itself?

That lazy philosophy also, it seems, extends to the pipeline’s safety record. In fact, people not knowing the Colonial pipeline even existed has probably helped shield the company from more attention for a scandal that is arguably on par with the hack: causing the biggest gasoline leak in decades.

In August of last year, teenagers riding ATVs in a suburb outside of Charlotte spotted gasoline bubbling from the ground in a nature preserve, where the pipeline was routed underground. Colonial initially said that only 63,000 gallons of gasoline had been spilled, but slowly revised its estimates all the way up to 1.2 million gallons by March. A few weeks before the May hack, the company told the North Carolina Department of Environmental Quality that even that 1.2 million gallon estimate might be an undercount of the actual damage done.

While the company said in March that it is still investigating the cause of the spill, the portion of the pipe where the leak sprang was last repaired following a leak in 2004. The federal government agency that regulates pipeline safety seemed to confirm that the North Carolina spill was the result of the company dragging its feet on maintaining the decades-old pipeline.

“Colonial’s inability to effectively detect and respond to this release, as well as other past releases, has potentially exacerbated the impacts of this and numerous other failures over the operational history of Colonial’s entire system,” the Pipeline and Hazardous Materials Safety Administration wrote in a Notice of Proposed Safety Order on the leak, which was addressed to Blount, in late March. “After evaluating the preliminary findings of fact described below and considering the characteristics of the Colonial Pipeline System, as well as the failure history of that system, it appears that the continued operation of the Colonial Pipeline System without corrective measures would pose a pipeline integrity risk to public safety, property, or the environment.”

A major spill like this should be frontpage news—especially since it wasn’t the first accident with the aging pipeline in recent years. In the fall of 2016, an accident along the pipeline in Alabama caused an explosion that killed two workers and injured four; another incident a month earlier spilled more than 252,000 gallons of gasoline in the same county. These two accidents set off a small gasoline shortage panic in 6 states, a mini version of what we saw this month.

But in the case of this year’s North Carolina spill, anonymity for the company along with the slow drip of information from Colonial’s press team did its job. By the time the jaw-dropping 1.2 million gallon estimate was reached, the initial news cycle around the leak itself had died down, and national outlets were slow to pick up the story. (The company also bought out three properties near the leak site, spending more on those purchases than it’s spent on environmental penalties over the past 30 years.)

In retrospect, it is kind of bonkers that more people didn’t know about Colonial before a bunch of grade-school–level hackers managed to shut it down and, by extension, hold a chunk of the U.S. hostage. The pipeline is a Koch-controlled piece of infrastructure that was largely built decades ago that pumps millions of gallons of gasoline per day underground through 12 states. People have died due to accidents along the line. The company, it seems, is either so disorganized or so secretive—or both—that even after 9 months of analysis, they still can’t seem to get a handle on just how much gasoline leaked last August. Is it any surprise that these are the guys that got hacked?

Fortunately, more people are starting to pay attention to pipeline safety in general. The latest Colonial disaster has only served to remind us about just how little oversight we conduct on the oil and gas infrastructure we rely on—an awareness that doesn’t seem likely to go away. Apologies in advance to Mr. Blount for making his job a little harder in the years to come.