On June 8th of last year, an explosion occurred at the Freeport Liquified Natural
Gas (Freeport LNG) export and terminal plant on Texas’ Quintana Island. Initial
investigations suggested that the incident occurred in pipe racks that support
transfer from the storage tank areas to the dock facilities at the terminal. Early
reports from Freeport’s executives pointed to the overpressure and rupture of a
segment of line, causing rapid flashing of LNG and the release and ignition of the
natural gas vapor cloud.

What is LNG?

Liquified Natural Gas (LNG) is basically just natural gas (methane) that has been
processed for shipment, typically via large-volume double-hulled ships. This is
done by cooling the gas (as vapor) to a temperature of about -260 degrees
Fahrenheit, at which time it becomes liquid. This is important for two reasons.
First, it shrinks the volume being transported by almost 600 times, allowing
shipment to make sense economically. Natural gas is typically transported in its
liquid state via pipelines. However, liquefying natural gas allows shipment to
areas not accessible via pipelines, including overseas markets. Once delivered,
most of the LNG is returned to its gaseous state, at which point it can be delivered
to distribution companies, power plants, and industrial consumers via pipeline. A
smaller portion is retained in liquid form and used as a fuel source for various
transportation vehicles.

Why It's Suddenly A Big Deal

Russia has long dominated the Eastern European market for gas and surely wants
to continue doing so. They have invested heavily in a system of at least eleven
different pipelines, supplying product to thirteen different countries, some of
which are extremely reliant on Russian gas. The market mentioned most
prominently is Germany, which receives almost one-third of its natural gas via
these pipeline systems. However, at least twelve other Eastern
European/Western Asian countries also rely greatly on Russia to supply their
natural gas needs. It is considered to be the least carbon-intensive fossil fuel and
has multiple important uses. Once warmed, it reverts back to natural gas methane)for heating, cooking, generation of electricity, and other industrial uses. Or, as stated earlier, it can be used in its liquid form to serve as a viable transportation fuel alternative.

Russia has long been concerned with US LNG exports. It is viewed as a means “to
undercut Russia’s domination of the gas market”. The explosion, and its
implications, had an immediate impact on European gas prices, reinforcing
Russia’s domination of gas supplies to Europe. Further, US LNG futures have
“fallen significantly” since the event, as per Tom Rogan, National Security Writer
and Online Editor for the Washington Examiner. Of importance is Freeport’s
contribution to our LNG exports, being single-handedly responsible for almost
twenty percent of total volume. It is not expected to be back on line until early
2024, or later.

Why Freeport?

The Freeport facility has importance to both the US and Russia for several
reasons. First and foremost, it is the largest of the eleven major US terminals
online, accounting for about twenty percent of all LNG exports. And of this
twenty percent, where do you think the bulk of it goes? Eastern Europe. At lease
eighty percent of that total goes to Germany and surrounding countries. The June
8th occurrence had an immediate impact spiking already soaring European gas
prices and has reinforced Russia’s ability to hold gas supplies to Europe at risk in
retaliation for the European Union sanctions imposed on Russia over the war in
Ukraine. Further, US LNG futures have fallen significantly since the occurrence.
Both events are prominent in helping Russia continue to stake-out and hold its
position as the prominent source for Eastern European energy supplies.

Previous Incidents

Russia has a history of using malware and similar weapons to affect US facilities
dating back to at least 2012. In March 2023, almost exactly a year ago. The DOJ
(Department of Justice) charged four Russian nationalists accused of using
TRINTON malware in several different attacks on US soil between 2012 and 2018.
They have also been accused of overriding a Triconex safety system during a 2017
attack on a Saudi petrochemical plant, causing it to explode.

The Department of Energy (DOJ) and Certified Information Systems Auditor (CISA)
relentlessly send out warnings about Russia’s threat to critical infrastructure. On
February 21, 2023, a Marathon refinery explosion occurred, coincidentally the
same day the US imposed sanctions on Russia. At least 34 food-processing plant
fires in little over a year and temporary loss of control of SCADA (Supervisory
Control and Data Acquisition) systems have also occurred. Neither the Department of Energy (DOE) nor CiSA has, or will, provide any information regarding these instances.

What Actually Happened at Freeport?

It is still unclear as to why the many safety mechanisms at Freeport failed to
prevent the event. Russia does have (and has used) malware known as TRITON
which is linked to a Russian-based APT group XENOTIME and it has proven to be
capable of shutting down industry safeguards and damaging industrial facilities, facilities that have remarkable flaws regarding their internal security and malware defense.  Many questions remain unanswered and industry experts are dissatisfied with the government’s response, or lack hereof. Local columnist Michael Morris was just
one of many who expressed frustration regarding information shared with the
surrounding community. Many think Mr. Putin has thumbed his nose at previous
White House warnings

.
One thing we do know is this, and assuredly other similar facilities, are vastly
unguarded. According to the Industrial Automation and Control system (IAC), 69
of the 138 individual cyber security requirements could not be met. This included
such remedial things as passwords. According to Ankit Suthar, an industry expert,
there were no passwords for the systems, even by default. “You simply plug in
your HART (Highway Addressable Remote Transducer) communicator and change
whatever you wish”. A number of maintenance devices, with direct connections
to the Internet, have no cyber security whatsoever. These are just two examples
of access points that can be used as entry points into the safety equipment and
control systems used at the Freeport LNG facility.

Many questions remain unanswered and industry experts are dissatisfied with the
government’s response, or lack hereof. Local columnist Michael Morris was just
one of many who expressed frustration regarding information shared with the
surrounding community. Many think Mr. Putin has thumbed his nose at previous
White House warnings.

Quoting Tom Rogan again, he has confirmed that the incident is “consistent with”
previous hacking attempts by the Russians, adding that the facility did not have in
place the Operational Technology/Industrial Control Systems network detection
systems. “Unless Freeport LNG has OT/ICS network detection systems deployed
appropriately and has completed a forensic investigation, a cyberattack cannot be
ruled out.” Interestingly enough, about the time Russia began its invasion of
Ukraine, a cyber unit of Russia’s GRU military intelligence was confirmed to have
conducted “targeting reconnaissance operations” against Freeport, as per the
American Military News website.

Other Opinions/Explanations

Freeport’s Director of Corporate Communications, Heather Browne, called the
investigation “ongoing” but insisted the incident was not a product of a
cyberattack. “Our internal cyber detections systems have been confirmed to have
been functioning properly and do not indicate any manipulation or compromise of
our security solutions.” She insists it was simply a matter of over-pressurization
whereby the supercooled liquid was being forced, at 917 pounds per square inch,
through a pipe designed to handle no more than 90 pounds PSI. Further, she
claims the pipe was “flawed” and not designed to handle cryogenic temperatures.
Her denials cannot be discounted. The Federal Pipeline and Hazardous Materials
Safety Administration has hit the facility with eleven enforcement actions since
early 2015, more than any other facility on the US Gulf Coast. The recent
explosion was the fourth incident reported since 2019, the year Freeport first
began exporting gas. A safety expert cited “poor planning” and called the
frequency of incidents “alarming”.

The Verdict?

This is one you will have to decide for yourself. It does seem to be strangely
coincidental that the incident occurred almost simultaneously with Russia’s
invasion on Ukraine. Further, the prior event at the Marathon facility occurred on
the exact same date that the US declared sanctions on Russia. Just last May,
Russia was identified as being responsible for a successful “ransomware attack”
which forced a major US pipeline to shut down for nearly a week. In response,
President Biden met with President Putin and declared certain critical
infrastructure to be “off-limits” to cyberattacks by either country. Jim Gerathy, National Security and Defense Analyst for the National Review, says that Russian Involvement would be nothing less than an "attack on America" and effectively "declared war".

Not surprisingly, the government was tight-lipped about the situation saying “we
can neither confirm nor deny the existence of any investigation into this matter”.
This should be no surprise to the American public. The government has long kept
“sensitive” information from us, many times claiming it’s for our own good or that
national security could be comprised. Why should Biden be any more
forthcoming that any previous administration? The chances of us actually
knowing what happened at Freeport are slim to none, and none just left town……
So….what do you think? Accident or sabotage? I encourage each reader to form
their own opinion. The truth will likely never be known.