OTC 12161

Countering Petroleum Security Risks

Ronald Relf and Gary Stubblefield, GlobalOptions

Copyright 2000, Offshore Technology Conference

terrorist threat, it should be clearly understood that a
This paper was prepared for presentation at the 2000 Offshore Technology Conference held in disgruntled employee could easily contemplate or undertake
Houston, Texas, 1–4 May 2000.
actions which would relegate him/her to the standing of
This paper was selected for presentation by the OTC Program Committee following review of “insider terrorist.” Multinational oil companies have offices
information contained in an abstract submitted by the author(s). Contents of the paper, as
presented, have not been reviewed by the Offshore Technology Conference and are subject to worldwide, many of which are located in the backyard of
correction by the author(s). The material, as presented, does not necessarily reflect any
position of the Offshore Technology Conference or its officers. Electronic reproduction, known terrorist groups and in regions that regularly suffer
distribution, or storage of any part of this paper for commercial purposes without the written
consent of the Offshore Technology Conference is prohibited. Permission to reproduce in print
political and economic upheaval. As a symbol of great wealth
is restricted to an abstract of not more than 300 words; illustrations may not be copied. The and power, the oil industry is often the target of political or
abstract must contain conspicuous acknowledgment of where and by whom the paper was
presented. environmental campaigns. Human rights groups and leftist
guerillas blame oil revenues for breeding corruption and
artificially propping up despots. Through attacks on petroleum
Abstract
companies, they seek to reduce the flow of petrodollars and
thereby force reforms
Acts of violence directed at the oil industry continue to
and/or topple corrupt
escalate on a worldwide basis. To reduce financial losses and
regimes. Many pipelines
enhance the security of employees and assets, executives are
transverse ecologically
advised to take the following proactive steps:
fragile terrain, putting
companies at odds with
• Conduct an independent threat assessment to
environmental groups.
determine if current security systems are adequate to
Remote oil fields and
protect against potential terrorist/extremist threats and
pipelines that stretch
the loss of property;
hundreds of miles are
• Implement advanced security systems and procedures difficult to defend from
based on identified risks to reduce violent attacks and attacks. In dense jungles, for example, terrorist groups can
minimize liability concerns; bomb pipelines then slip away with little fear of being caught.
• Regularly reassess security threats and update crisis Combining all of these factors1, it is easy to understand why
management/business continuity plans to manage the petroleum industry faces unusually difficult challenges in
risks and minimize costly interruptions in the protecting its employees and assets from acts of violence.
exploration and production of oil.
To develop strategies to safeguard the petroleum industry, it is
Introduction instructive to examine tactics from a terrorist’s perspective. It
is generally understood that terrorist groups select targets
Businesses are most often the target of terrorist groups, based on an internal analysis. When considering the use of
according the U.S. State Department. And of all businesses, terror, they weigh the question: Will an attack precipitate
the petroleum industry is the most likely to be attacked. Of sufficient damage and/or anxiety, and thus achieve its goal,
approximately 1,800 terrorist incidents that were recorded without triggering a backlash? To misjudge the assessment
from 1987 to 1997, about half were directed at business can risk disaster. Thus, one can surmise that an attack by such
interests. In some regions of the world, such as South and a group is carefully calculated and planned in advance of the
Central America, private industry is the overwhelming target incident. To the extent that advanced security measures are
of choice by extremist groups. Throughout Latin America in introduced to counter such threats, the risk to terrorists will
1997, there were only three terrorist attacks against the U.S. rise and they can be deterred from striking the targets.
government, one private citizen incident, and 87 violent acts
directed at private companies.

The petroleum industry is uniquely vulnerable to acts of 1

terrorism and crime. While this paper focuses largely on the Discussion of the issue of Force Majeure coverage is not
addressed in this paper.
2 RONALD H. RELF AND GARY STUBBLEFIELD OTC 12161

Not all terrorists groups act logically, however. Terrorism can Terrorist groups in these nations have vowed revenge. Bin
be divided into three categories: rational, psychological, and Laden called on all Muslims to “obey God’s command to kill
cultural. the Americans…wherever he finds them.” To strike the U.S.,
it appears he may have assisted Ahmed Ressam, arrested in
• The rational terrorist examines goals and options to Seattle in December for attempting to smuggle bomb-making
determine what will advance a cause. In other words, a materials into the United States.
cost-benefit analysis is undertaken to evaluate the scope
of an attack and its potential to achieve an intended goal. Similarly, terrorist attacks against oil companies can be
triggered by seemingly minor events, such at the President’s
• Psychological terrorists are motivated by dissatisfaction travel itinerary. To protest Clinton’s visit to Greece, terrorists
with life and personal accomplishments. They do not bombed Texaco’s offices in Athens. Experts believe the attack
discern right from wrong; views outside their group hold may have been carried out by Christian Orthodox Serbs, who
little or no merit and are perceived to be based on evil also organized massive demonstrations to protest America’s
motives. Victims are dehumanized and there is no bombing campaign in Yugoslavia.
remorse or ambiguity when undertaking an attack.
Not all security threats to the petroleum industry are related to
• Terrorists motivated by culture—which includes terrorism or politics. Alfred Heinz Reumayr, a convicted felon
nationalism, religion, and race—are especially dedicated from Canada, planned an elaborate scheme to blow up the
to their cause. Many people do not fully appreciate the trans-Alaska oil pipeline, then reap a windfall in profits when
degree to which culture can motivate behavior and the the price of oil escalated. Reumayr planned to detonate 14
potential danger these groups pose. Threats to the culture bombs along three sections of the pipeline on January 1, 2000,
with which a terrorist identifies can trigger extreme to coincide with the new millennium. Before he could carry
aggression. Terrorist attacks that would otherwise be out his plot, an informant who Reumayr knew in prison,
viewed as extraordinary acts of desperation can become a tipped off authorities and he was arrested by the Royal
duty in the minds of a culturally motivated terrorist. Canadian Mounted Police.

The petroleum industry, because of its high-profile and global As deadly as terrorist/guerilla attacks can be, potentially even
operations, must guard against attacks from all three terrorist more damaging is the hand of Mother Nature. Earthquakes,
camps, as well as guerillas, warring ethnic tribes, and corrupt floods, and hurricanes can deliver a deathblow to businesses
political regimes competing for oil profits. The severity and that are unprepared. Companies involved in natural disaster
broad range of threats necessitates employment of advanced frequently never recover. Sixty percent of all businesses that
security procedures, ranging from on-the-ground operations to shut their doors, even for one day, as a result of a natural
political, legal and communications contingency support. disaster never reopen them. Adequate security measures can
Companies must sustain a high level of security awareness. mitigate considerable post-natural disaster expense.
Procedures and planning must be highly integrated.
Strike at the Most Vulnerable Target
The security of American
petroleum companies is, in In most cases, terrorists and guerillas strike where
part, inextricably linked to vulnerabilities are greater than the ability—or initiative—to
U.S. foreign policy interests, deter or defend against such acts of violence. The logic is not
which can dramatically unlike criminals who target victims or businesses that are the
change overnight. In the past least prepared to defend against an attack.
24 months, the United States
bombed four sovereign The “strike the most vulnerable target” strategy is played out
nations: Iraq, Sudan, regularly on the world stage. In the petroleum industry,
Afghanistan and Yugoslavia. terrorists and /or extremist groups rarely mount attacks against
Three of these countries are well-secured facilities and personnel. In a survey of violent
predominantly Muslim. incidents over the past decade, the most popular target, not
Sudan and Iraq are listed by surprisingly, is an oil pipeline. Extremists groups regularly
the State Department as state blow up sections of pipe with timed improvised explosive
sponsors of international devices, disappearing into the surrounding countryside with
terrorism. Afghanistan is little worry of arrest. The cost of repairs can run into the
providing a safe haven for Osama Bin Laden, a sponsor and hundreds of thousands of dollars. When lost revenues are
financier of Islamic extremist causes, who is believed to have considered, losses reach into the millions.
masterminded the bombings of the U.S. Embassies in Nairobi,
Kenya, and Dar es Salaam, Tanzania in 1998.
OTC 12161 INCREASED GLOBAL PETROLEUM SECURITY RISKS 3

In Colombia, leftist guerillas are attacking an oil pipeline, on • Five British oil workers were reported kidnapped, in three
average, once every five days. The problem is so severe, separate incidents. Two of the workers were taken
Colombia officials worry they may have to begin importing oil hostage when armed raiders hijacked their ship. One of
to meet future demand. Occidental Petroleum, one of four U.S. those two later died after release from a disease
oil companies operating in Colombia, confesses it is “getting contracted while being held hostage.
clobbered.” In years past, guerillas would attack a pipeline
then run away, explains Robert Stewart, spokesman for • Pirates chased down an oil company tanker in high-speed
Occidental. “Now, they sit around after, have a cup of coffee boats and held the captain and several crew members
and wait for the army to show up.” hostage. Their complaint: the captain had failed to
secure local permission to carry out exploration and
The rebels also regularly attempt to drilling operations in the area.
extort payments from the oil
companies. In 1998, guerillas passed a • Offshore platforms are also vulnerable. On one occasion,
note to a truck driver for a U.S. oil more than 100 irate villagers descended upon a platform
company. The note requested a operated by 63 workers. The villagers were unarmed but
meeting with company officials to extremely hostile. During the incident, tribal members
work out an agreement that would hijacked a tugboat that was servicing the platform.
allow it to “work without problems.”
If the company refused to comply, the Security has deteriorated to such an extent in Nigeria that oil
rebels warned they would “not be companies are considering providing funds to help train the
responsible for the consequences.” police. Assisting law enforcement may boost security, but the
The company refused to be policy is risky and could backfire, unleashing a spate of
blackmailed and forwarded the note to Colombian military lawsuits. Chevron is already engaged in a major court battle
intelligence. Employing a broader strategy which further with a U.S. human rights group, which alleges the company is
impacts oil companies, rebels target contractors hired to repair responsible for the deaths of two protestors who were killed
the pipelines and demand a ten percent “commission” from by Nigerian soldiers and police on an oil rig in the Niger
contractors for safe passage. Delta. Shell Oil Company is embroiled in a contentious suit
with human rights activists that allege the company, because
Examples of Risk of its ties to the Nigerian government, shares responsibility for
the hangings of Ken Saro-wiwa and John Kpuinen.
The history of oil company overseas risk is replete with
examples. Oil companies operating in the African nation of Beyond the borders of Colombia and Nigeria, pipeline
Nigeria suffer substantial losses from attacks to personnel and bombings have occurred in nearly every country where oil is
property; industry experts estimate attacks during the first six produced or transshipped, including Chad, Cameroon,
months of 1999 cost these companies more than $1 Billion. Thailand, Algeria, Burma, Sudan, Philippines, Ecuador,
The world’s sixth largest oil exporter, Nigeria offers an Russia, Turkey, and Yemen. And many violent incidents are
excellent example of the diversity of risks to which oil never reported because of inaction by authorities, fear of
companies are subjected. reprisal, or to downplay the problem. This lack of reporting
tends to mask the true severity of the problem.
• In October of 1999, extremists from the Choba Youth
Association raided the Choba offices of Wilbros Limited, In Pakistan, four auditors from Union Texas were gunned
an oil service company headquartered in Oklahoma. Two down in the port city of Karachi. Authorities believe the
Americans and a British worker were assaulted and held ambush was in retaliation for the conviction of Mir Aimal
hostage. After being holed up for several days, riot police Kasi, a Pakistani who murdered two men outside CIA
stormed the building and killed four of the militants. headquarters in Langley, Virginia. Union Texas is currently
the defendant in a lawsuit alleging it failed to adequately
• In 1998, the Ijaw (the fourth largest tribe in Nigeria) protect its employees.
seized drilling rigs and oil terminals operated by
American petroleum companies to put pressure on the In addition to politically
government to boost the share the tribe receives from oil motivated attacks, oil companies
revenues. must be alert to everyday
criminal activities. In many parts
• In another area of the country, Nigerians from the of the world, vandalism, theft,
Ekakpamre village blocked roads with palm trees and robberies, pickpockets, violent
attacked flow stations, forcing workers to abandon the demonstrations, and homicides
wells. are near epidemic levels. The
4 RONALD H. RELF AND GARY STUBBLEFIELD OTC 12161

murder rate in Colombia, for example, is eight times higher systems, can be utilized to detect incidents as they develop.
than the United States. Travel can be dangerous even in Then specially crafted response plans can be initiated to
private planes. A business jet flying from Asmera, Eritrea’s apprehend the perpetrators. In some instances, it may not be
capital, to Djibouti, was shot out of the sky. The pilots had possible to quickly intervene, in which case prudent, pre-
filed a normal flight plan and were clearly within air planned steps can be taken to delay potential violent actions or
boundaries when the tragedy occurred near Ethiopia. make preparations to best defend against an attack.

What To Do? The world’s top security companies, in addition to security

expertise, can provide investigative, political, legal, and
Oil companies have little choice but to operate in developing communications support. When operating in troublesome
countries that are often engulfed in political turmoil and foreign countries, these resources can be brought to bear as a
corruption. Given the diversity and frequency of security package to solve difficult security-related problems. Ranging
threats, how can executives best protect employees and from rudimentary to highly sophisticated, effective security
property? What can be done to guard against financial losses? operations can be implemented to respond to security threats.

In most cases, violent attacks involve human behavior that is The list of concerns to be considered in establishing and
predictable. If an incident is predictable, it is also preventable. maintaining a proactive security posture is lengthy. One
Terrorists and criminals rely on surprise and a victim’s fundamental area is personal awareness which requires pro-
confusion when attacked. A high-level awareness posture, in active participation at all corporate levels. Three examples are
combination with advanced security measures and training, illustrative:
offers the best strategy to deter acts of violence and crime. The
goals of any security program are to: • Deterrence begins when potential security risks are
recognized. Employees working aboard—from corporate
• Prevent/deter the criminal/terrorist executives to field employees—must understand the
• Detect criminal/terrorist activity importance of security awareness and familiarity with
• Facilitate rapid response to minimize consequences of an local and regional customs, politics, social concerns, and
incident potential security risks. They need to remain abreast of
• Provide post-investigative support developments in U.S. policy and activities which might
• Apply “lessons learned” to improve security impact them.

Looking at the range of problems with which the oil industry • Informational briefings should be concise and well
must contend, more than ever they are at risk. To defend organized so everyone can quickly identify critical
against these numerous threats, the threat environment must be situations and respond appropriately. Personnel should be
clearly understood. Comprehension is then followed by prepared for any contingency; knowing how and when to
assessing a company’s vulnerability to that threat. react can save one’s life.

Assessments by independent security analysts are valuable to • Information about potential threats should be updated
guard against multimillion-dollar liability suits. The average frequently, circulated as appropriate, and incorporated
cost to a company that fails to adequately protect an employee into crisis management plans for such things as
is eight million dollars. Conducting independent threat emergency medical evacuation, protection of high-value
analyses and periodic reassessments ensures that security equipment, critical incident resolution, business
systems in place are sufficient to counter identified threats. continuity, disaster recovery, and asset recovery.
By being proactive, industry executives can reduce risks and
prevent major crises that can endanger employees and Summary
property. If a crisis should occur, executives can be confident
established procedures are adequate to resolve a wide variety Increasing security and reducing vulnerability can be
of problems. An outside analysis of current threats and summarized as a pro-active, three-phase process:
security measures by firms with expertise in this aspect of
security will validate the effectiveness of current plans and (1) Assess the threat and the company’s vulnerability to
procedures. that threat.
(2) Implement procedures and systems to deter, counter,
Oil companies need not be and mitigate the threat.
complacent about attacks on (3) Routinely test security procedures and systems and
pipelines and other facilities. institute changes/improvements as warranted.
Advanced technologies, such as
tumblers and other early warning
OTC 12161 INCREASED GLOBAL PETROLEUM SECURITY RISKS 5

Every situation is unique, requiring tailored plans… not glossy improves employee productivity and makes it easier to attract
generalities or “off the shelf” policies and procedures. top professionals to manage facilities in difficult areas.
Information from a threat assessment is used to develop
security measures to “target harden” facilities and protect
employees. It is essential that security measures are
commensurate with identified threats, and whatever the degree
of security instituted, it must be sustained. It may be
necessary to periodically tighten security in response to a
specific threat. However, it is important to remember that
inappropriate over-reaction can result in security measures
being briefly implemented then removed (or ignored) when
the threat appears to have diminished. Terrorists and criminals
are adept at observing security arrangements and are often
content to wait until procedures relax before initiating an
attack.

Based on personal experience, we have found that

corporations often miscalculate problems because they assess
situations based on American standards instead of local
conditions. As a result, what is viewed as an acceptable risk
may, in fact, be a serious concern.

When dealing with human behavior, there is always the

possibility of irrational or unexpected incidents. Knowing that
every crisis cannot be prevented, contingency plans should be
developed to assist executives in managing potential
problems. Crisis management planning is but another way to
demonstrate to potential adversaries that for every action they
may contemplate, there is a prepared response to counter the
action.

Developing business continuity plans that address a wide

range of potential problems will dramatically enhance a
company’s odds of surviving a critical situation, save lives,
and maintain production with minimal financial loss.

Conclusion

Risks to the petroleum industry are on the rise, as are liability

costs associated with failure to prudently and adequately
protect against a threat. As these threats have increased,
security technologies and procedures to counter these
problems have also improved.

Companies can proactively employ security systems to

safeguard their employees and property no matter where they
may be working. Systems can be implemented to protect the
most vulnerable targets, such as pipelines. Security
professionals who possess an operational background in
planning and deterring/countering sabotage are uniquely
qualified to design advanced systems to provide companies a
distinct advantage when dealing with threats from terrorists,
guerillas, or criminals.

Investing in advanced security systems makes good business

sense. Keeping oil facilities operating by reducing the number
and severity of attacks boosts company profits. Good security