Boardwalk Pipelines’ business is dependent upon its computer systems, devices and networks (operational and information technology), and those of its customers, suppliers and others with whom Boardwalk Pipelines does business, to collect, process and store the data necessary to conduct almost all aspects of its business, including the operation of its pipeline and storage facilities and the recording and reporting of commercial and financial information. Despite Boardwalk Pipelines’ security measures, the information and operational technology and infrastructure it relies on may be vulnerable to attacks by third parties, such as hackers, cybercriminals, nation-states, insiders or other third parties, or breached due to human error, malfeasance or other disruptions. Through government intelligence reports, Boardwalk Pipelines is aware of credible global threats to third-party, U.S. critical infrastructure sectors on which it depends, such as the telecommunications sector.
Cybersecurity threat actors have attacked and continue to threaten energy infrastructure. The U.S. government has issued public and industry-directed warnings that indicate that energy assets might be specific targets of cybersecurity attacks, which are increasing in sophistication, magnitude and frequency. Vulnerabilities in one environment may affect other interconnected systems. A cybersecurity incident that impacts a third party with whom Boardwalk Pipelines does business may impact Boardwalk Pipelines.
Some cyber incidents, such as surveillance, may go unnoticed for a long period of time. Any investigation of a cybersecurity attack or other security incident will be inherently unpredictable and complex, and it may take significant time before the completion of any investigation and availability of full and reliable information. During such time, Boardwalk Pipelines may not know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, any or all of which could further increase the costs and consequences of a cybersecurity attack or other security incident, and its remediation efforts may not be successful.
As the cybersecurity threat landscape continues to evolve, Boardwalk Pipelines may be required to expend significant additional resources to continue to modify or enhance its protective measures or to investigate and remediate any information security vulnerabilities. Advances in computer capabilities, discoveries in the field of artificial intelligence, cryptography, inadequate facility security or other developments may result in a compromise or breach of the technology Boardwalk Pipelines uses to safeguard its operational and information technology systems and confidential, personal, or otherwise protected information. As the breadth and complexity of the technologies Boardwalk Pipelines uses continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet, the potential risk of cyberattacks and cybersecurity incidents also increases. No security measure is infallible. Despite ongoing efforts to improve its ability to protect its systems from compromise, Boardwalk Pipelines may not be able to protect all of its diverse systems. Boardwalk Pipelines’ efforts to improve security and protect data and its systems may also identify previously undiscovered instances of security breaches or other cyber incidents.
TSA has issued a series of security directives applicable to pipeline owners and operators, which require the implementation of a variety of cybersecurity measures and reporting. Other regulators, such as PHMSA and the SEC, have also established requirements for reporting certain cybersecurity incidents. As cybersecurity incidents continue to evolve, more legislation could be enacted to seek to mitigate cybersecurity threats. This may require Boardwalk Pipelines to expend additional resources to continue to modify or enhance its protective measures or to investigate and remediate vulnerabilities to cybersecurity incidents at significantly increased costs. Boardwalk Pipelines cannot predict the potential impact to its business of potential future legislation, regulations or orders relating to cybersecurity.
A failure, security breach, disruption or degradation impacting Boardwalk Pipelines’ operational or information technology systems or those of third parties with whom it does business could negatively affect its ability to safely and reliably operate its assets and/or result in delays in providing services for its customers, contamination or degradation of the products it transports and store, damage to or destruction of its or third-party pipelines, property or facilities, catastrophic events, injury or death to its employees or other persons, the inadvertent release of hydrocarbons or the release or destruction of confidential, proprietary or business-critical information or intellectual property, which could result in outages, reduced revenue, unexpected costs and expenses, litigation and reputational damage, any or all of which may be irreversible and may materially adversely affect its results of operations, cash flows, financial condition and ability to operate its business.
In addition, access, disclosure or other loss of information or other consequences could result in legal claims or proceedings, liability under laws that protect the privacy of personal information or personally identifiable information, regulatory penalties for divulging or failing to adequately protect such information, disruption of Boardwalk Pipelines’ operations, incident response and remediation costs, damage to its reputation, and loss of confidence in its services.