A Holistic Response

A coordinated attack on a country's energy infrastructure (EI) can have untold economic and humanitarian consequences and lead to cascading damages across a variety of sectors. Examples abound: In Nigeria, rebel attacks on pipelines, refineries, storage tankers and oil companies have decreased the country's oil output by 20 percent, resulting in billions of lost government revenue. During the Sri Lankan civil war, the Tamil Tigers bombed an electricity plant, shutting down energy in Colombo, a city with more than half-a-million inhabitants. During the mid-1990s, the French company Gaz de France withdrew 200 expatriate employees from Algeria after Islamic militants killed two foreign technicians in an assault on the country’s oil and gas sector.

In addition, Columbia, Iraq, Sudan and Saudi Arabia, to name a few, have witnessed politically motivated attacks on and/or plots to target their energy infrastructure. The apparently broad geographic appeal of attacks begs the question of how to appropriately respond and mitigate threats to EI. ‘Hardening,’ or increasing, the security of infrastructure is certainly an important element. However, partnerships and collaboration between public and private stakeholders play an increasingly important role. A comprehensive approach is needed, one that embraces the role of intelligence gathering to effectively counter this phenomenon.  

Hardening the target: Investing in security

Certainly, one element in deterring attacks is making them more difficult to carry out. Saudi Arabia, the world’s top oil exporter, has invested heavily in the security of its valuable energy sector. This country, situated in a volatile region, inflamed with radicalization and violent non-state actors (VNSA), is not immune to threats. The 2006 attack on Abqaiq oil facility, the largest oil processing plant in the world, highlights both VSNA desire to attack a symbolic EI target and their lack of capability to penetrate Saudi hardened facilities. While the perpetrators managed to detonate their devices, the attack was unsuccessful in that it did not get past the checkpoints and thus caused no significant damage. This comes as little surprise. Examining the security apparatus reveals a facility that is protected by three electrified security fences, helicopters, F-15 warplanes and security personnel. As Nawaf Obaid, managing director of Saudi National Security Assessment Project, a government consultancy, external pagemaintainscall_made, "Unless you have a specialized force of a foreign army, such attacks are impossible to succeed."  

How much money Aramco, the Saudi state oil company, spends to protect its energy assets is not known, but the fact that no major attacks have occurred since 2006 speaks for itself. Recognizing the global interest to target energy assets, though, Saudi Arabia continues to invest in security, as demonstrated by the 2007 founding of the Petroleum Facilities Force that aims to employ 35,000 men and create a sophisticated air-defense system. In addition to the security measures mentioned before, the Arab oil industry is protected by a system of resiliency, meaning that if production is disrupted at some point, it will be shifted to other assets or locations. Since the state controls the oil production, there is no need for public-private ventures. Nonetheless, the Saudi royal family has a history of working with the US, as evidenced by the deployment of the US navy forces to the Persian Gulf to thwart any terrorist attacks. Additionally, Saudi Arabia is one of the biggest weapons purchasers in the US, acquiring Apache helicopters, light-armored vehicles and other weapons totaling billions of dollars.

Public-Private Cooperation

The Saudi case, however, is unique in that most producer countries rely on partnerships with public and private entities, where both governments and multinational oil and gas companies must cooperate in order to address security risks. Without a comprehensive approach that encompasses both the public and the private sector, the risk of terrorist attacks cannot be alleviated.

This is evident when examining the Colombian case where, since the 1980s, the Caño Limón-Coveñas oil pipeline has been heavily targeted by members from the Revolutionary Armed Forces of Colombia (FARC) and National Liberation Army (ELN) – resulting in losses up to 500 million dollars a year. Through an aggressive public-private response, however, attacks external pagedeclinedcall_made from their high-point of 170 in 2001 (resulting in 266 days that the pipeline did not operate), to 41 in 2002. The United States government, recognizing the importance of Colombia as the fourth-largest Latin American crude producer, spent roughly 98 million dollars to help safeguard the pipeline and train the Colombian Special Forces to better protect it as well.

Moreover, Ecopetrol and Occidental Petroleum Corporation, the Los Angeles-based Colombian oil company that jointly operates the Caño Limón pipeline and oilfield, external pageparticipatedcall_made decisively in its protection and supplied financial support to enhance security. Occidental’s instrumentation, for instance, senses a drop in the pipeline pressure, whenever an attack on the pipeline occurs. This prompts the Colombian Air Force to confirm the attack and deploy soldiers if necessary. Once the location is secured, Occidental personnel have access to the damaged area to repair the pipeline.

Such public-private relationships and security investments vary depending on the country. This creates vulnerabilities and opportunities for disruption within the entire EI chain. In fact, many producer countries not only lack strong partnerships but also regulation and a comprehensive security framework. For example in the US, Larry Ness author of external pageSecuring Utility and Energy Infrastructurescall_madeand president of external pageNess Group Internationalcall_made explains:

“All US companies work directly with the US government regulators, and their respective State government regulators. In the United States we have FERC (Federal Energy Regulatory Commission) which develops security standards for the utility industry, with input from the private and public sector Utilities. A good example is Cyber Security Standards which protect our Nation's Grid System from being hacked. These standards were developed by FERC with input from the Utilities themselves, security experts, and Federal/State law enforcement agencies.”

Apart from regulatory standards, there is also the issue of public-private partnership in combating terrorism where Ness notes: “Post 911, working with the Urban Utility Center in New York City Ness Group International put a security program in place to protect all underground infrastructures (water, gas, electric, cable, telecommunications, etc.). This was accomplished by bringing all Utility providers to the table along with representatives from the Mayor’s Office, NYPD, Federal Law Enforcement and New York State government.” 

Taking Intelligence into the picture

In addition to developing the framework and standards for EI protection, the intelligence community can also greatly contribute to energy asset protection. As Dr Martin Rudner, founding Director of the Canadian Centre of Intelligence and Security Studies at Carleton University, maintains: "Essentially, there are two approaches to the protection of energy infrastructure. First, there is the protective approach, in other words, the policing of certain assets like in the Colombian case. Second, there is the proactive approach that aims at preventing attacks from occurring in the first place. Both approaches are needed. You may not always be able to detect or prevent attacks and if one occurs then protection becomes vital."  

In most industrialized economies, energy infrastructures belong to and are operated by the private sector yet represent a critical state asset. Despite this inherent partnership, multinational companies do not have the same capacity and knowledge about potential threats to EI that the intelligence community may have acquired through its sources. Granted, the intelligence community does not reveal any methods or sources, it can share tactical and strategic insights that could be vital to the protection of the energy sector. More specifically, intelligence agencies are able to produce threat assessments of terrorist intentions and capabilities regarding energy infrastructure targeting. In sum, contingency plans developed in cooperation with energy companies can help to prepare, prevent and respond to attacks.

Seeing this cooperation in action, Dr. Rudner highlights a meeting that takes place twice a year, which brings together Natural Resources Canada, representatives of the Canadian intelligence community, the Royal Canadian Mountain Police and stakeholders of the private sector to meet for a classified briefing on energy infrastructure security. All participants have a security clearance, so an open forum is created in which intelligence information as well as perspectives from the energy industry are exchanged. “This Canadian approach to high-level intelligence-sharing is probably unique in the Western world,” Dr. Rudner finds. It also showcases how insights from the public and private sector can be brought together with the view of enhancing EI security.  

Given the asymmetric nature of today’s threats in the face of non-state foes, the intelligence agencies in most democratic jurisdictions have become increasingly involved in the prosecution and conviction of suspected terrorists, or rather violent non-state actors. Toward that end, sensitive information will likely need to be disclosed in court, which amounts to a new departure for most intelligence agencies. For instance, in the Crevice case in the United Kingdom, evidence from the intelligence community was presented and led to the conviction of five men that plotted to attack utility companies in order to cut off electricity, water and gas supplies across the country.

All told, a comprehensive approach which leverages the capacity and knowledge of both the public and private sector is needed in order to adequately protect global energy infrastructure. As illustrated in Saudi Arabia, hardening plays a significant role, but many producer states in similar volatile regions don’t necessarily have the means or the will to undertake such measures. Partnerships can fill this gap by developing common standards, allocating financial assistance, working with the community and liaising with intelligence resources with the aim of preventing attacks.