| Recurring |
one_organization, multiple_organization |
(a) The software failure incident having happened again at one_organization:
Telvent, a company that monitors more than half the oil and gas pipelines in North America, was infiltrated by Chinese hackers in September 2012. The hackers were discovered in Telvent's computer systems after they had been present for months, prompting the company to close its remote access to clients' systems to prevent potential infrastructure shutdowns [116379].
(b) The software failure incident having happened again at multiple_organization:
The article mentions that Chinese-backed hackers targeted and breached nearly two dozen companies that own oil and gas pipelines from 2011 to 2013. Specifically, 13 out of 23 operators of natural gas pipelines were successfully compromised through spear phishing attacks, while three were "near misses." Additionally, the Department of Homeland Security reported responding to intrusions on oil pipelines and electric power operators at an alarming rate nearly 10 years ago, with some attacks traced back to China [116379]. |
| Phase (Design/Operation) |
design, operation |
(a) The software failure incident related to the design phase can be seen in the article where it mentions that Chinese-backed hackers targeted and breached nearly two dozen companies that own oil and gas pipelines through a form of email fraud known as spear phishing [116379]. This indicates a failure in the design of the security systems or protocols that allowed the hackers to successfully compromise 13 out of 23 operators.
(b) The software failure incident related to the operation phase is evident in the article where it describes how the Colonial Pipeline was forced to shut down its shipments after a ransomware attack, fearing the unknown capabilities of the attackers [116379]. This operational failure led to long gasoline lines and shortages, highlighting the impact of operational disruptions on critical infrastructure. |
| Boundary (Internal/External) |
within_system, outside_system |
(a) within_system: The software failure incident related to the cyberattacks on American oil and gas pipelines, particularly the Colonial Pipeline attack, was primarily due to contributing factors that originated from within the system. The hackers targeted the industrial control networks that run the pipelines, aiming to gain strategic access for future operations rather than just stealing intellectual property [116379]. The failure was exacerbated by vulnerabilities in the pipeline operators' systems, as evidenced by successful compromises through spear phishing attacks and the lack of data on the extent of intrusions into some operators [116379].
(b) outside_system: The software failure incident was also influenced by contributing factors that originated from outside the system. The cyberattacks were state-sponsored, with Chinese-backed hackers targeting and breaching companies that own oil and gas pipelines [116379]. The attacks were part of a broader trend of nation-backed hackers targeting critical infrastructure, highlighting the external threat landscape faced by these systems [116379]. |
| Nature (Human/Non-human) |
non-human_actions, human_actions |
(a) The software failure incident occurring due to non-human actions:
The software failure incident in this case was primarily due to state-sponsored cyberattacks on American oil and gas pipelines by Chinese-backed hackers. The hackers targeted the industrial control networks that run the pipelines, aiming to gain strategic access for future operations rather than just intellectual property theft. The attacks involved spear phishing and breaches into the systems of pipeline operators, with the goal of holding U.S. pipeline infrastructure at risk [116379].
(b) The software failure incident occurring due to human actions:
The failure can also be attributed to human actions, particularly the lack of adequate cybersecurity measures and vulnerabilities in the systems of pipeline operators. The failure to implement robust security protocols and the successful breaches through spear phishing indicate a failure on the part of humans responsible for maintaining the security of these critical infrastructure systems [116379]. |
| Dimension (Hardware/Software) |
software |
(a) The articles do not provide information about a software failure incident occurring due to contributing factors originating in hardware.
(b) The software failure incident reported in the articles is related to a cyberattack on American oil and gas pipelines by Chinese-backed hackers. The hackers targeted the industrial control networks that run the pipelines, aiming to gain strategic access for future operations rather than just stealing intellectual property. The incident involved breaches through email fraud like spear phishing, with some operators successfully compromised and others experiencing near misses. The hackers were preparing to take control of the pipelines, potentially leading to physical damage or disruption of operations [116379]. |
| Objective (Malicious/Non-malicious) |
malicious |
(a) The objective of the software failure incident was malicious. The failure was due to state-sponsored cyberattacks on American oil and gas pipelines by Chinese-backed hackers. The hackers targeted the industrial control networks that run the pipelines with the intention of gaining strategic access for future operations, such as physically damaging pipelines or disrupting pipeline operations [116379]. |
| Intent (Poor/Accidental Decisions) |
poor_decisions, accidental_decisions |
The intent of the software failure incident related to the reported cyberattacks on American oil and gas pipelines appears to be a combination of poor_decisions and accidental_decisions:
(a) poor_decisions: The failure can be attributed to poor decisions made by the hackers, such as the Chinese-backed hackers targeting and breaching companies that own pipelines with the intent to gain strategic access to industrial control networks for future operations rather than just for intellectual property theft [116379]. Additionally, the failure can be linked to poor decisions made by the pipeline operators who were successfully compromised due to spear phishing attacks, indicating a lack of robust cybersecurity measures in place [116379].
(b) accidental_decisions: The failure can also be attributed to accidental decisions or unintended consequences, such as the ransomware attack on Colonial Pipeline that led to the shutdown of the pipeline network, causing gasoline shortages and disruptions in fuel supply [116379]. This incident highlights how unintended decisions or actions, like paying a ransom in cryptocurrency, can have significant consequences on critical infrastructure. |
| Capability (Incompetence/Accidental) |
accidental |
(a) The articles do not provide information about a software failure incident occurring due to development incompetence.
(b) The software failure incident related to accidental factors is the cyberattack on American oil and gas pipelines by Chinese-backed hackers. The hackers targeted the industrial control networks of the pipelines through spear phishing and successfully compromised several operators [116379]. |
| Duration |
temporary |
The software failure incident related to the cyberattacks on American oil and gas pipelines can be considered as a temporary failure. This is evident from the fact that the cyberattacks, particularly the ransomware attack on Colonial Pipeline, led to a temporary shutdown of the pipeline network due to security concerns and uncertainties about the attackers' capabilities [116379]. The incident caused disruptions in fuel supply, leading to long gasoline lines and shortages [116379]. The ransomware attack on Colonial Pipeline resulted in the company paying a ransom of about $4 million in cryptocurrency to the attackers [116379]. Additionally, the incident prompted the federal government to issue security directives to enhance cybersecurity measures for critical infrastructure, indicating a response to a specific set of circumstances rather than a permanent failure [116379]. |
| Behaviour |
omission, other |
(a) crash: The software failure incident related to the cyberattack on the Colonial Pipeline led the company to shut off its shipments for fear of not knowing what the attackers would be capable of next, resulting in a shutdown of the pipeline network [116379].
(b) omission: The failure of the software systems in the context of the cyberattack on the Colonial Pipeline resulted in the omission of the intended functions of the pipeline operations, leading to the shutdown of shipments [116379].
(c) timing: The software failure incident related to the cyberattack on the Colonial Pipeline resulted in the system performing its intended functions too late, as the company had to shut off its shipments after the attack [116379].
(d) value: The software failure incident related to the cyberattack on the Colonial Pipeline resulted in the system performing its intended functions incorrectly, as the attackers were aiming to gain control of the pipelines rather than just stealing technology [116379].
(e) byzantine: The software failure incident related to the cyberattack on the Colonial Pipeline involved the system behaving erroneously with inconsistent responses and interactions, as the attackers were preparing to take control of the pipelines for future operations [116379].
(f) other: The software failure incident related to the cyberattack on the Colonial Pipeline also involved the system behaving in a way not described in the options provided, such as the system being vulnerable to ransomware attacks and the need for increased security measures to protect critical infrastructure [116379]. |