I think parent may mean infrastructure side. If it had just attacked the office side of things, it would be the usual 'company infected with ransomware' story without affecting the public.

The truly cynical take is that they managed to take down Colonial's billing. In response, Colonial shut down the pipeline - because obviously delivering oil without getting paid is out of the question.

Yes, it's guesswork and pretty extreme conjecture but it has just the right amount of coldheartedness to it: https://zetter.substack.com/p/biden-declares-state-of-emerge...

The Colonial Pipeline Is Finally Back Online and Pumping Gas https://www.thedrive.com/news/40583/the-colonial-pipeline-is...

> New details from within Colonial Pipeline have come to light surrounding the decision to shut off supply. Those briefed on the matter have suggested that fuel flows were shut down due to the company's billing system being compromised. Company officials were reportedly concerned that they would not be able to accurately bill customers for fuel delivered, and chose to stop delivery instead.

I hope they will be hit with massive fines. That sort of reasoning should be absolutely unacceptable... Billing system going down should not take down critical infra...

Billing/reservation systems going down would take down logistics in many infrastructures, whether it's pipelines, airlines, trucking or anything else.

> should be absolutely unacceptable... Billing system going down should not take down critical infra

It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.

When you become critical national infrastructure, the calculus changes. For any company in that position, their NUMBER ONE priority is to keep operating and providing their deemed essential service.

Colonial obviously have done well in certain ways: their business side and operational side are decoupled. Business side got hit with a major IT problem - and the damage was contained. Pipelines kept working as intended. That's good operational planning, and they deserve credit for it. They were perfectly capable of, quite literally, keeping the lights on for 100M people.

> It’s a privately financed, constructed and operated pipeline. I don’t see why they should be obligated to operate without getting paid.

Because they are critical infrastructure. Colonial are entitled to their profits as long as they keep their side of the bargain: supply oil and fuel for those 100M people who critically depend on them.

This is where role of a regulation comes in. Make it the critical supplier's responsibility to ensure that they supply. If they lose their billing capability, that's their problem. Not their customers'.

The real villain was capitalism all along?!

Who's been messin' up everything...

The more charitable take on this is that if one system is compromised, there's a high chance others may be, so if you have safety-critical systems and you're not absolutely certain they were properly air-gapped from the compromised system, shutting them down may be the safest course of action.

In truth both factors probably played a role in this case, perhaps also with a hefty dose of "our software literally can't run if billing is down because it was never designed to handle that".

They don't actually own the oil they're pumping, right? So if their billing was compromised to the point that they don't know what oil needs to be pumped where, they had a legal duty to refrain from pumping it willynilly.

Shouldn’t they have a paper-based/offline downtime procedure for this?

(Oh shit, everything just went down, turn on the generator, go plug that printer and laptop in, and print off all the reports of where we were from the offsite/offline/whatever backup).

What did they do before computers?

Failing to plan is planning to fail and all.

I like the idea of monthly planned downtimes where possible so people don’t run around like a headless chicken when things go down. No different than a fire drill.

> Shouldn’t they have a paper-based/offline downtime procedure for this?

If they did, I would expect their employees to be out of practice with such methods since they weren't working that way day-to-day. Unless they're running regular "all computers are down"-drills to keep their employees sharp, downtime was probably inevitable.

Hence the monthly planned downtimes. Some organizations require you to take your vacation time every year, and it’s partly because they want to make sure they know how to operate without you.

While watching the USSR collapse in real time, I noted a reporter say the core of the breakdown was inability to issue paychecks to bureaucrats. No pay = no bureaucracy = no government.

I've long wondered if that really was the case, seemed absolutely sensible...

My understanding is they did limit the attack to the office side:

> After Colonial Pipeline reported that its corporate computer networks were hit by the ransomware attack, the company shut down the pipeline as a precaution due to a concern that the hackers might have obtained information allowing them to carry out further attacks on vulnerable parts of the pipeline.

https://en.wikipedia.org/wiki/Colonial_Pipeline_cyberattack

Business side manages financial transactions. Sales, accounts receivable, accounts payable...

Operations side performs whatever services the business side has committed to.