E8-24487. Solicitation of Comments on the Process and Technologies Used for Disseminating the Weekly Petroelum Status Report and the Weekly Natural Gas Storage Report

AGENCY:

Energy Information Administration (EIA), Department of Energy (DOE).

ACTION:

Solicitation of comments on the process and technologies used for disseminating the Weekly Petroleum Status Report and the Weekly Natural Gas Storage Report.

SUMMARY:

The EIA is requesting comments on the process and technologies used for disseminating weekly information regarding petroleum and natural gas stocks in the Weekly Petroleum Status Report (WPSR) and the Weekly Natural Gas Storage Report (WNGSR). EIA has attempted to develop its current dissemination processes and information technologies to meet its goal of providing fair access to any interested user, but has recently faced significant challenges in this area that may require changes in the process and/or technologies used for disseminating weekly data. This request is based on EIA's mandate for carrying out a central, comprehensive and unified energy data and information program responsive to users' needs for credible, reliable and timely energy information that will improve and broaden understanding of petroleum and natural gas supply in the United States.

DATES:

Comments must be filed by November 14, 2008. If you anticipate difficulty in submitting comments within that period, contact the person listed below as soon as possible.

ADDRESSES:

Comments should be directed to Karen Robinson, Office of Oil and Gas. To ensure receipt of the comments by the due date, submission by FAX [phone]) or e-mail ([e-mail]) is recommended. The mailing address is Office of Oil and Gas, Energy Information Administration, EI-40, Forrestal Building, U.S. Department of Energy, 1000 Independence Ave., SW., Washington, DC 20585. Alternatively, Karen Robinson may be contacted by telephone at [phone].

FOR FURTHER INFORMATION CONTACT:

Requests for additional information should be directed to Karen Robinson as listed above.

SUPPLEMENTARY INFORMATION:

I. Background

II. Issues with Dissemination of Weekly Reports

III. Request for Comments

I. Background

Every week, the EIA's Office of Oil and Gas releases two reports, one on the previous week's U.S. petroleum supply and disposition and one on natural gas storage inventories. Together, these reports provide the industry, press, planners, policymakers, consumers, analysts, and State and local governments with a ready, reliable source of current information about petroleum and natural gas.

The WPSR has provided timely information on supply and disposition of crude oil and principal petroleum products since April 1979. The WPSR was initiated to increase available information during a period of gasoline shortages arising from the repercussions of the revolution in Iran. The WPSR describes the supply and disposition of crude oil and petroleum products in the United States in major U.S. regions called Petroleum Administration for Defense Districts. The weekly data are used as preliminary estimates for the Petroleum Supply Monthly (PSM) and the Monthly Energy Review (MER). While more accurate and detailed data are presented in the PSM based on monthly surveys, those surveys do not capture sudden or rapid changes in petroleum market conditions nor do they provide data that are timely enough to be useful in a shortfall situation.

The WNGSR has provided weekly estimates of working natural gas volumes held in underground storage facilities at the national and regional levels since May 2002. Weekly estimates of working natural gas in storage were first provided by the American Gas Association (AGA) starting in 1994. EIA picked up the report when the AGA announced that it would discontinue its survey. The WNGSR relies on weekly survey data from a sample of operators of underground storage facilities. These data are used to prepare regional and national estimates for all underground storage. In September 2007 the WNGSR was designated by the Office of Management and Budget as DOE's first Principal Federal Economic Indicator.

Over time, interest in both the WPSR and the WNGSR has increased. Weekly WPSR and WNGSR results are routinely predicted by analysts, and deviations from analysts' expectations are often cited as moving futures markets in petroleum and natural gas.

As one part of its response to a problem that arose in the release of WPSR data on May 29, 2008, press releases issued on May 29, 2008 and June 2, 2008, announced EIA's intention to open a dialogue to discuss the technical and process challenges facing EIA in this area with users interested in accessing weekly data, including the press, trading organizations and other parties. This Federal Register notice initiates that dialogue. Following the exchange of information with stakeholders, EIA will develop a specific proposal for a comprehensive release process that is both fair and takes account of changing technologies and post that proposal in the Federal Register for comment. After considering comments, EIA will decide on and publicly announce its revised comprehensive release process before any changes are implemented.

II. Issues With Dissemination of Weekly Reports

EIA's interest is in providing fair access to any interested user, regardless of the nature of their interest, whether that interest is commercial, journalistic, academic, policy or general interest. EIA's dissemination process and information technologies attempt to meet that goal.

EIA's current practice is to load the WPSR and WNGSR on its Web site prior to the scheduled release time, behind a software “gate” that prevents access to the reports before the release time. At the release time, the gate is removed, and interested parties have access to the information.

Because oil and natural gas market participants respond extremely quickly to the information, the commercial value of the information is high but decays extremely quickly. The use of automated retrieval programs known as “robots” to access online data in combination with the ability to program trading based on data received by robots through electronic interfaces in oil and natural gas commodities markets (both futures and over-the-counter swaps) creates a situation where small time differences in access to this information can have commercial implications.

Consistent with the intense immediate interest and the quick decay in the commercial value of the information, demand on EIA servers increases significantly over just a few seconds around release times. For example, during the first half of 2008, attempts to access the Web site for the WPSR at about the time of release rose from fewer than 100 hits per second to a typical peak between 1,000 and 5,000 hits per second. One hour before or after the release, hits per second are at much lower levels. The immediate reason for the surge in hits on the EIA web site is the more active use of robots. In EIA's experience, although most robots have not performed at excessive levels, some robots have been designed to submit requests so rapidly that their load has reduced overall server performance and impaired access to others.

EIA has attempted to manage this weekly demand for WPSR data and, to a lesser degree, the WNGSR, through the application of a new process and technologies designed to meet the goal of providing fair access to any interested user. However, in a Web environment, strategies used by EIA's customers evolve constantly, requiring continuous refinement of EIA's process and information technologies to meet its goal of providing all EIA customers with fair access to our data. Two recent experiences illustrate the challenges faced by EIA in this area.

On May 29, 2008, petroleum data published in the WPSR for the week ending May 23, 2008, was briefly made available on the public EIA Web site prior to its scheduled release time of 10:30 a.m. (Eastern Time) due to a combination of procedural and information technology errors involving the process and technologies deployed in response to the rise in robot activity. EIA reviewed what happened on May 29, 2008, and took significant actions to stabilize its systems and strengthen its processes. In a press release on the day of the incident, EIA provided information on initial indications of the problem and stated that interim changes necessary to avoid a recurrence would be made available no later than June 2, 2008, two days ahead of the next scheduled weekly data release. The May 29, 2008, press release and another one issued on June 2, 2008, announced EIA's intention to open a dialogue with customers on the process and technologies for dissemination of the weekly data. The June 2, 2008, press release also outlined the following interim changes:

1. Temporary process changes, including a delay in WNGSR and WPSR data releases until 10:35 a.m., to assure the inaccessibility of data;

2. Release of WNGSR and WPSR 30 minutes apart when releases are scheduled to occur on the same day during weeks with a Federal holiday on a Monday;

3. Immediate implementation of a policy to block robots that are accessing the Web site in any way that EIA considers excessive or malicious or that do not contain contact or identifying information; and,

4. A reminder that EIA may report robot activity in accordance with its Security Policy, which could result in criminal prosecution under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996 (Pub. L. 104-294), (18 U.S.C. 1030), or other applicable criminal laws.

Internally, EIA thoroughly tested its software, both in regular operations and under stressed conditions, and eliminated all identified problems. EIA also has revised its process, increasing the communication across EIA staff before and during release to identify potential issues, proactively develop actions to minimize risk and assure that all employees act in accordance with written procedures.

EIA's actions have materially reduced the likelihood of a repeated early release of the WPSR, but stress on the process and systems remains due to the increasing level of interest in the WPSR and WNGSR at release time. EIA's interim actions were primarily designed to stabilize and improve its process and system. In addition, the actions did remind those accessing WPSR and WNGSR data that EIA policy permitted more active EIA responses to manage certain types of behaviors.

The most aggressive activity did subside for some time after the May 29, 2008, incident and the issuance of the May 29, 2008, and June 2, 2008, press releases. More recently, however, the most aggressive visitors have increased their activity significantly. For example, on September 10, 2008, some parties attempting to reach the WPSR faced delays in access until after the release time directly because of the aggressive behavior of others. On that day, robots launched from several IP addresses impeded access to EIA's servers for several seconds by repeatedly downloading the same WPSR data—hundreds or thousands of times—without relinquishing their connections. This activity impaired other users' access to the data.

EIA is continuing to explore technological alternatives to permit it to achieve its goal of providing fair access to WPSR and WNGSR data as close to simultaneously as possible to any interested user, regardless of the nature of their interest, whether it is commercial, journalistic, academic, policy or general interest. Since September 10, 2008, EIA has more actively blocked robots from IP addresses with prior patterns of excessive attempts to download information. EIA is developing the ability to block real-time activity beyond predetermined thresholds. And, as indicated above, EIA has asserted its intent to report robot activity in accordance with its Security Policy, which could result in criminal prosecution under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996 (Pub. L. 104-294), (18 U.S.C. 1030), or other applicable criminal laws.

The technical requirements to manage increasingly aggressive behavior by apparently increasing numbers of interested parties in a highly technological environment are extraordinary. The complexity is increased at the same time by EIA's and DOE's needs to manage cyber security in a Governmental context of tight budgets and very fast change. In some ways, the problem may be without precedent—the functional equivalent, whether intended or not, of a prescheduled denial-of-service attack twice a week. Incremental technology and process solutions may not be enough to assure that fair access to WPSR and WNGSR data is available to all interested users.

III. Request for Comments

EIA is asking for public comment on the issues discussed in item II. In particular, EIA is seeking public comments on the following questions:

A. EIA's interest is in providing fair access to any interested user, regardless of the nature of their interest, whether that interest is commercial, journalistic, academic, policy or general interest. EIA has attempted to develop its dissemination process and information technologies to meet that goal.

1. EIA releases information it collects in the normal course of its business. Release of that information is for the public good, rather than for any particular commercial reason. The commercial value of the information to users underscores its importance, but is entirely outside of EIA's mandate. Other than protecting its own information technology infrastructure, should EIA be concerned over the accessibility of the information it disseminates on its Web site if some users experience delays in accessing the weekly data?

2. Disseminating information simultaneously over the web is not physically possible. Servers process information sequentially and communication connections to servers have physical limitations that mean, in absolute terms, the information does not move “simultaneously.” However, very small time differences may not be material. In the case of release of the WPSR and WNGSR, do minor delays involving one to fifty seconds in accessing information undermine EIA's policy to promote fair access in operational terms?

3. The value of WPSR and WNGSR information varies for different customers. With the development of electronic trading in oil and natural gas commodities—both futures and swaps—the ability to use software “robots” to access online data and the ability to automate trading based on data received by robots through electronic interfaces, a time difference in access to this information on the order of even a second or two could have implications for commercial users. Journalists and possibly certain consultants will want to communicate this information to commercial users as well, and very short-period access differences matter for these data users as well. Those with academic, policy or general interests may not need this information within seconds of its release. Should EIA consider possible technological solutions to provide access to this information on different time frames? Would treating different types of customers differently be a problem? If so, why and how?

4. A registration system could permit registered customers to have the most immediate access to data in exchange for contact information and an agreement to access information using procedures and methods that do not put other customers at risk for delayed access. Should EIA require registration for customers needing immediate access to this data and what guidelines would be reasonable for users to follow?

B. EIA's current practice is to load the WPSR and WNGSR on its Web site prior to the scheduled release time, behind a software “gate” that prevents access to the reports before the release time. At the release time, the gate is removed, and interested parties have access to the information. Currently, the releases occur at times when trading of energy futures on the New York Mercantile Exchange is open.

1. Is a web release of information the best way to disseminate that information? Are there alternatives that would be more effective? For example, are there reliable “push” technologies that could come closer to simultaneous access—ways for EIA to send the information to interested parties rather than simply posting it?

2. Are there particular technologies that EIA should be considering to (a) manage the brief, extraordinarily high loads associated with the WPSR and WNGSR releases, (b) block aggressive behaviors reducing service quality to others (inadvertently or intentionally), and (c) protect data after it is loaded onto the servers and before its release? Technologies could include software solutions, hardware and hardware configurations, etc.

3. Should EIA consider moving the release times for the WPSR and WNGSR? Most other economic and commodity data is released either before or after major U.S. stock and commodity exchanges are open. With the advent of electronic trading, NYMEX regularly trades petroleum and natural gas futures from 6 p.m. to the next day at 5:15 p.m. every day except Saturday afternoon into Sunday. This schedule typically leaves only a 45-minute window when trades do not take place during the work week. Online trading in over-the-counter swaps effectively takes place continuously. Are there times for release of the WPSR and WNGSR that better align with trading activity?

C. EIA has more actively blocked robots from IP addresses with prior patterns of extremely aggressive behavior. EIA is developing the ability to block activity by robots beyond pre-determined thresholds.

1. Should EIA consider banning use of robots to access this data?

2. Should EIA continue to block robots based on their level of activity? If so, what criteria should EIA use to block them? Historical behavior? Real-time behavior?

3. Could EIA develop and distribute a standard robot designed to regulate traffic by managing how hard it hit the EIA Web site, allowing for blocking of non-standard designs and possibly identifying users to allow for more effective follow-up?

D. EIA has asserted its intent to report robot activity in accordance with its Security Policy, which could result in criminal prosecution under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996 (Pub. L. 104-294), (18 U.S.C. 1030), or other applicable criminal laws. At what point does tying-up access to EIA's servers for several seconds by repeatedly downloading the same without relinquishing connections data—hundreds or thousands of times—become effectively a cyber security attack? What standards should EIA apply to make that determination?

Comments submitted in response to this notice will be considered by EIA in the development of future dissemination policies, processes and systems. The comments will also become a matter of public record.

After consideration of the comments, EIA will issue a description of revised policies, processes and technologies used for disseminating the WPSR and the WNGSR. The description will be announced in a Federal Register notice issued by EIA.

Statutory Authority: 15 U.S.C. 764(b) and 790(a).

Issued in Washington, DC, October 8, 2008.

Howard Gruenspecht,

Acting Administrator, Energy Information Administration.