HOUSTON – Dayna Hickman, her husband and two young kids live in the shadows of some of the largest refineries in the world.
She is acutely aware of what has happened in the last couple of years in places like Baytown, Crosby and Deer Park.
“I’ve been in the southeast Texas region since I was four years old,” Hickman said. “If there’s an explosion, if there’s a power outage, what am I going to do? I’d be lying to you if I said I didn’t think about it.”
For the Hickmans, it’s not a matter of “if”, but “when” their luck will run out. So while Hickman hopes for the best but she’s prepared for the worst — a catastrophic failure, a massive explosion, or a life-threatening release of toxic chemicals.
“Our town has an alarm system set in case there is an issue in any of the plants or refineries,” Hickman said. “The alarm goes off every Wednesday at 4 p.m."
Assessing the threat
The United States is the world’s leading oil producer and Houston is the heart of it with 10 refineries producing more than 2.5 million barrels of oil each day. Add in dozens of chemical plants and the Houston area is a target-rich environment for cybercriminals.
“The threats are real and they are happening,” said Eddie Habibi, founder and CEO of PAS Global, a leading cybersecurity firm.
Petroleum and chemical refining is a complicated, multilevel process with risks up-and-down the production chain. Like other industries, oil companies started using the internet in the 1990s to connect their networks and automate their processes, exposing themselves to cyberattacks.
“These control systems were not originally designed with cybersecurity in mind,” Habibi said.
According to Habibi, three groups are responsible for the bulk of industrial cyber attacks:
- Hacktivists, who want to demonize companies and damage their reputations
- Ransomware attackers, who take control of a company’s operations until a ransom is paid
- Nation-states who present the biggest threat with armies of computer scientists, who continuously hunting for weaknesses and are ready to attack
“The notion of a nation-state attack another country’s infrastructure is not a phantom, it’s not a myth, it is true,” Habibi said. “Cybersecurity is being viewed as a weapon of war.”
How law enforcement deals with it
Houston’s FBI office has one of the largest teams in the country dedicated to cyberterrorism. Agents are very aware of threats against the oil and gas industry, but they don’t think a “doomsday” type of attack is likely here.
“In most cases, I would bet that foreign governments would not want to engage in that activity on U.S. soil,” said Supervisory Special Agent Jason Lowder. “It doesn’t mean it couldn’t happen, but it’s just the probability, in my opinion, is low.”
Still, cybersecurity experts say these facilities need to be ready.
“There’s a lot of work to be done,” Habibi said. “We are not there yet, but I’m confident we can stay ahead of the bad guys.”
If not, Dayna Hickman says her family will be ready.
“I’m not scared, because I’m prepared.”