Offshore installation security

Record keeping of security incidents of offshore installations dates back to the 1960s,[10] but it was not until the early 1980s that possible threats were first addressed within academic literature.[11][10] This lack of protection left the assets vulnerable to attacks;[2][10][17] however, with the Achille Lauro attack in 1985, the awareness for the protection of maritime targets, including offshore installations, increased.[2] The attack is seen as a major driver for the 1988 adoption of the Convention For The Suppression Of Unlawful Acts Against The Safety Of Maritime Navigation (SUA Act) criminalizes behavior of crime or violence against ships including attacks of terrorism and piracy.[12][19] The signing of the accompanying SUA Protocol, the Protocol for the Suppression of Unlawful Acts against the Safety of Fixed Platforms Located on the Continental Shelf , which prohibits and punishes behavior that may threaten the security of offshore fixed platforms is seen to present a milestone in offshore installation security.[2] In the same year Brian Michael Jenkins published a paper under the RAND Corporation and was the first to comprehensively list a record of historical attacks on offshore installations and identify the main methods of attack.[10] By the late 1980s the awareness of installation security had increased, and the first international legal regulation was in place. Nevertheless, industry standards with regards to the protection of offshore installations were still low.[17]

The 9/11 attacks marked a turning point in the international awareness and policy towards the comprehensive protection of offshore energy sector as political engagement with the topic increased.[4][2]Moreover, since 2004, the international community experienced an increase in the attacks on offshore installation due to reasons such as the increased capabilities of adversaries, political instability within certain nations, and armed conflicts in oil producing countries. For example, since 2006 the conflict in the Niger Delta has resulted in increased attacks in the Gulf of Guinea and raised security level.[13]

According to the IEA,the security of offshore oil and gas industry is currently of economic and strategic importance as about one quarter of the global energy supply stems from offshore sources.[4][2][9][6] [20] The resulting overall development towards heightened awareness and recognition of the issue has affected the organization of the offshore oil and gas sector within their installations. For example, some companies include a security division within their Health, Safety & Environment departments.[21] This overall development has brought changes to the international regulatory framework; namely, the passing of the ISPS Codes and the 2005 amendments to the 1988 SUA Convention and Protocol. Additionally, national laws have been enacted to include critical infrastructure protection policies (for further information see below 'Protection Mechanisms').[14][17]

Possible injury or death of offshore workers need to be considered. Attacks may result in grave injuries or other medical consequences, or loss of life in the worst case.[10][4]

A materialized security threat may result in the disruption of the functioning of the offshore installation due to the damage or harm on the operational site.[14]

The consequences of oil spills, especially in the high seas, may be grave.[27] A possible oil spill may cause long-lasting damage to the immediate environment, but may have wider implications too. For example, the food security of a region may be compromised due to water contamination.[4] Not only may water offshore and in coastal waters be affected, but it also may cause toxic effects on shorelines and shallow inshore waters.[15] This could have a negative effect on the population living in the region.

A successful attack may result in economic concerns for a variety of people who are involved. First, for the operating company may suffer damage and also a loss of income when production is stalled. Additionally, a disruption of oil and gas supply to the market may result in volatile oil prices, which would carry an effect on global economy and the stock exchange.[28][6][7] An oil spill may also have significant effects on other sectors such as local fisheries and tourism which could experience losses.

With the offshore oil and gas sector being one fourth of the global energy production, offshore oil and gas extraction has become increasingly important in the evolving world energy scene.[7][17] Petroleum, as one of the most important energy resources of the earth, will remain an essential part of the global energy demand also in the future, as demands are not projected to curtail.[7] Thus, an uninterrupted petroleum supply is essential in light of the global energy security as a sustained disruption in oil supply may cause national emergencies.[14][2][29]

A sustained disruption in oil and gas supply may also cause geopolitical concerns. It could present a weakened position of a nation within global politics as it loses power within those factors that govern international relations.[17]

The 1982 United Nations Convention on the Law of the Sea (UNCLOS) provides a basic legal basis for protecting offshore installations.[30] Typically, offshore installations are deployed either in the territorial sea, the contiguous zone, or the exclusive economic zone (EEZ) of a coastal state. Whilst the coastal state has full enforcement jurisdiction over all security matters in the territorial sea, in the contiguous zone it has also has powers over law enforcement issues which affect its domestic stability. This allows the coastal state to secure its offshore assets broadly through jurisdiction in these two zones. In the EEZ the rights are more limited, as the coastal state cannot restrict others’ right to innocently transit the waters. 'Art. 60 of UNCLOS' gives coastal states the right to create a 500-meter safety zone around offshore installations which designates it as an area of restricted navigation where any passing vessel or boat may be considered a potential security concern. Within this zone, personnel may take appropriate measures to stop those who pose the threat.[14][18]

The Convention for the Suppression of Unlawful Acts Against the Safety of Maritime Navigation (SUA Convention) and its accompanying Protocol for the Suppression of Unlawful Acts Against the Safety of Fixed Platforms Located on the Continental Shelf (SUA Protocol) criminalized behavior of crime, violence, or behavior that may threaten the security of ships and fixed platforms.[19] The main purpose of the Convention was to ensure that appropriate action is taken against those who have committed unlawful acts against vessels and offshore oil and gas infrastructure as it obliges contracting Governments either to extradite or prosecute alleged offenders.[2] The 2005 amendments, moreover, addressed vulnerable elements of the maritime-based oil and gas industry and drew attention to potential acts of terrorism. These actions establish that consideration should be also given also to the oil and gas industry.[14][17] With this the SUA Convention and Protocol provided the first international treaty and framework for combating and prosecuting criminals and terrorists who have attacked or used a tanker or a fixed oil or gas installation as part of a terrorist operation.[17][14]

The International Ship and Port Facility Security Code (ISPS) prescribed responsibilities to governments, companies and personnel to detect security threats and take preventive measures against security incidents affecting ships or port facilities used in international trade. It additionally introduced maritime security levels for quick crisis communication which provides industry members with a framework for crisis response. The ISPS Code is enacted in national law in the EU and the US.[31][17]

The International Association of Oil and Gas Producers is considered to be the voice of the global upstream oil and gas industry[32] and has published several documents in the form of reports that recommend best practices to be introduced in the oil and gas industry including enhanced security of energy installations.[16] The pertinent documents are:

• OGP Report No. 494 on Integrating Security in major projects - principles & guidelines[33]
• OGP Report No. 512 on Security Management System[34]
• IOGP Report No. 555 on Conducting Security Risk Assessments (SRA) in dynamic threat environments[35]

The voluntary international ISO Standards introduced recommendations and best practices for industry actors. The ISO 31000:2009 Risk Management: Principles and Guidelines is a standard presenting internationally accepted best practice frameworks and guidelines for action on risk management.[3][14] It presents a systematized protocol to identify, analyse, evaluate, and treat possible risks to support strategies for major safety and security incident prevention, response, and recovery. Implementation of these standards is designed to both prepare for and react to an security emergency.

RAMCAP™ or Risk Analysis and Management for Critical Asset Protection is a framework for analyzing and managing the risks associated with attacks against the United States national critical infrastructure assets. It provides an overarching 7-step methodology for assessment and management of risks and their impact. It has been developed by the American Society of Mechanical Engineers to be used by the staff and management of infrastructure facilities and is also used by the American industry to report to the US Department of Homeland Security[36][37][38][39]

CRISRRAM or Critical Infrastructures and Systems Risk and Resilience Assessment Methodology is a security methodology developed by the European Commission. It addresses risks and vulnerabilities of critical infrastructure at asset, system, and societal levels which takes into account environmental and man-made security hazards. It provides industry professionals with a framework to analyse, act, and a security emergency.[38]

The Security Vulnerability Assessment (SVA) Methodology for the Petroleum and Petrochemical Industries from the American Petroleum Institute and the National Petrochemical & Refiners Association aims at maintaining and increasing the security of energy facilities in the petroleum sector. The document establishes a Security Vulnerability Assessment (SVA) methodology to identify and analyse the threats and vulnerabilities those energy installations face.[38][25]

Moreover, general security risk management practices, such as enterprise risk management are employed throughout the sector.