If you're an oil company, the world can be a hostile and dangerous place. Whether your refinery is a target for terrorists intent on destroying infrastructure, your drilling rig is a target for environmental groups who oppose oil and gas development, or your employees are potential kidnapping targets as they travel abroad, it's best to be as prepared and as vigilant as possible when conducting operations.

"Terrorism has no rules and, as such, can't be defined by a society based on rules," wrote Neal Adams in his book "Terrorism & Oil." "Perhaps it's more proper to say that rules of terrorism, for they certainly exist, are in a parallel path with civilization, as they are each a means to an end but have no common elements."

Politically or ideologically motivated terrorist acts are different than criminal acts or acts of vandalism. But protection against terrorism will probably keep away the crooks and the kids with spray paint cans as well.

Planning for peace of mind

How does a company protect itself? It's not an easy task, and there is no one-size-fits-all solution; in other words, what works well in Nigeria might not work at all in Brazil. David Cromley is a vice president at Secure Solutions International (SSI), a consulting group composed of former CIA and FBI agents that offers terrorism preparedness for international companies. Based in Houston, the vast majority of the group's consulting is done for oil and gas companies.

Cromley said that most of SSI's clients are not blind to the dangers of terrorism. "Most companies today are really concerned about this," he said. "They don't want to be a victim of terrorism."
While most major companies that have worldwide operations are generally aware of the dangers, Cromley said they still tend to underestimate the potential risks. "We focus on known terrorist groups in the area and offer detailed consideration of the local political situation, even the local populace," he said. "It's very important to get a clear sense of these things and to do so by doing more than just reading the newspaper."

It's also important to have a thorough understanding of threats in each area of operation to avoid a "disconnect" between the security plan and the environment, he added.

Typically SSI will start by doing a Security Vulnerability Assessment, a programmatic analysis of the security profile of a facility. It studies potential threats and the planned counter-measures to mitigate those threats.

"We look at the measures versus the threats and try to devise scenarios around which groups would be most likely to bring harm to the facility," Cromley said. "For example, they might have a history of suicide bombs or of surreptitious entry into facilities, or of using insiders, people who get jobs at the facilities in order to sabotage them."

Steps include:

• A corporate risk profile, a high-level assessment of the vulnerability of company operations;
• Threat monitoring, where terrorism and security-related developments and trends are studied;
• Security incident response procedures, including immediate response actions, notification requirements, decision-making authority and dissemination of threat information;
• Minimum security standards, encompassing fundamental security practices for employees working or traveling abroad and minimum physical and procedural security requirements for facilities, offices and projects;
• Briefings for employees traveling abroad; and
• Consultations on general security issues.

SSI also does field risk assessments, security project management, security training, incident support and investigations.

Say cheese

Several devices are on the market that can help companies guard their assets against intruders. Closed-circuit television (CCTV) systems have been around for years and are widely used in surveillance and security applications. But they're not always the best solution for oilfield assets, which can be in very remote areas and often don't have the infrastructure to support such a system.

One option is infrared cameras such as the L-3 Communications Infrared Products Thermal-Eye thermal security cameras. They use thermal imaging to detect objects hidden in unlit areas or people lurking in shadowed corners that are invisible to the naked eye and virtually indistinguishable with other technologies. Thermal cameras provide complete visibility on the darkest of nights, on the water and in bad weather because they measure heat and not light.

The images speak for themselves. Thermal images shot at an airport, for instance, clearly show two people nearing a fence, where the unenhanced CCTV image shows nothing at all and the same image after image intensification is still vague enough to arouse little suspicion.

The cameras are small enough to be carried easily, operate alone and can be designed to fit within almost any standard enclosure. They can also be integrated with an existing CCTV system.

Another alternative is the Sentinel system offered by Intelepresence. Unlike standard CCTV systems, the Sentinel G2 is a small, ruggedized sensor system that can be left to its own devices monitoring activity around a facility. It includes a variety of sensors, including motion, passive infrared, pressure, magnetic and seismic, all of which are rugged, run on AA batteries and can be left alone for months without needing recharging. "Each sensor is about the size of your thumb, and the battery box and telemetry box that it plugs into is very small and lightweight," said John Totsch, president and chief executive officer of Intelepresence. "They're quick and easy to set up."

The net result is a small sensor box that can be programmed to "wake up" at certain times; ignore vehicle traffic if it's a normal occurrence; and tell when someone is approaching, ascertain how many people there are, what they're traveling in, how far away they are and how fast they're going. An add-on module will grab a cell signal out of the air and send a text message onto a modem or phone in real time to notify the operator that intruders are approaching.

"We're seeing a lot of interest from people who want to put in intrusion detection capabilities coupled with video capabilities in very remote or zero-infrastructure environments, areas where you really don't have utilities or other wired means of communication," Totsch said. "We can emplace one of these in an hour or two and leave it in place indefinitely."

Keeping out the riff-raff

Schlumberger Information Solutions (SIS) specializes in driving security into the core E&P business processes, and it all starts with "identity management," according to Colin Elliott, security marketing director. "We view Identity Management as one of the cornerstones for security - you must know who someone is before you decide how to handle that person," Elliott said.

Physical security is the first line of defense, and SIS provides smart cards for building access. Smart cards are used because these cards have not only a physical access chip allowing entry into a facility but also contain a "logical access" chip. This allows the card to securely store information such as digital certificates. These certificates provide a person's digital identity and allow companies to replace user IDs in traditional and/or petrotechnical applications as well as enable the added security of file and email encryption.

"The inclusion of the logical chip provides a platform to provide additional security services," Elliott said.
Access systems help keep unwanted visitors out of the facility. "Access systems are all based on providing one or more of the following: something you have, something you are or something you know," he said. "Physical access systems typically employ a single-factor authentication model (something you have, e.g. a corporate badge) to prevent unauthorized access. Newer systems use multi-factor authentication models, which may include biometrics solutions (something you are) or personal identification numbers or PINs (something you know) in addition to the badge. In many locations for Schlumberger and other oil and gas companies, access to specific buildings, floors or rooms depends on the particular corporate badge that you have, as each one is assigned to a particular person. Highly secure locations use biometrics and PINs in addition to the badges to prevent unauthorized access."

Innocence abroad

One of the biggest threats to an oil company is potential harm to employees living or traveling in dangerous places. Unfortunately the world's hydrocarbon resources aren't always found in the safest locales. Being mindful of potential kidnapping threats can help ensure safe passage.

"The fundamental point they need to understand is that the threat of kidnapping is more substantial in some places than others," Cromley said.

Mexico and Colombia, he said, are "vying for first place" in the list of places one is most likely to be kidnapped. Several other Latin American countries are also near the top. The Philippines is a surprisingly treacherous place. Nigeria heads the list of African countries, and of course in the Middle East Iraq and Saudi Arabia are obvious leaders. Cromley said that in certain parts of India where there is a great deal of political unrest, kidnappings are common, but oil company executives are rarely the target.

Despite the recent high-profile beheadings in Iraq and Saudi Arabia, most kidnappers can be bargained with. Cromley cited one example of a French citizen who was kidnapped in Iraq. Demands ranged from a request for there to be no relations between the French and Iraqi governments to a request that Muslim schoolgirls in France be allowed to wear headscarves to school. "'Or you could give us a few million dollars,'" Cromley quoted the kidnappers as saying. "A lot of kidnapping is done under the guise of ideology, but they're often fundamentally mercenary in nature."

If a kidnapping does occur, Cromley said it's very important for the oil company not to take on the negotiation process on its own. There are a few companies around the world that are skilled in this type of negotiation, and oil companies should avail themselves of those services.
Within the United States, Cromley said that regulations are still evolving in the wake of the 9/11 attacks, sometimes with conflicting results. In the meantime, companies should endeavor to comply with existing regulations but also take a careful look at their vulnerabilities.

"They are facing, overall, a real increase in threats, and they need to be vigilant," Cromley said.

Comments