Security against deliberate attacks

Energy is part of the security policy picture, and the Russian aggression will have consequences for the threat level facing the petroleum sector for a long time to come.

Norway’s role as a stable supplier of oil and gas to Europe has become more important than ever. The increased intelligence threat has challenged practice, technical solutions and regulation of information security.

Espionage services in other countries are mapping Norwegian petroleum operations. In a worst-case scenario, information can be utilised as the basis for sabotage. This concern will affect security work in coming years.

Measures taken

The Petroleum Safety Authority Norway (PSA) has contributed to improving security conditions in the industry by following up the players, by advising government ministries and by serving as a source of expertise for the industry, other agencies and society as a whole. Its follow-up of the industry is pursued through audits, dialogue and meetings on such issues as handling security incidents.

Demand from other government agencies for the PSA’s knowledge of the industry and for contributions to the national position picture and coordinating measures was high in 2022. These tasks were therefore given particularly high priority.

In line with its authority to conduct system-oriented and risk-based supervision of security, the PSA’s work in 2022 included audits of facilities and plants. Those offshore covered such areas as the logistics chain for personnel and materials through heliports and supply bases.

The main issues for the security audits were technical, organisational and operational barriers (various types of security measures), security risk analyses, security plans, governing documentation, expertise, and verification of measures described.

Meetings with the players were also held by the PSA on such topics as the prevailing risk picture, vulnerabilities, and measures for reducing the risk of deliberate attacks.

The companies are required to report security incidents to the PSA which fall within its area of responsibility. It is important that the players also have a good reporting culture in this field.

A number of observations were made in 2022 of possible unidentified drones/aircraft around facilities on the Norwegian continental shelf (NCS) and at land plants. Such objects could increase risk, particularly for helicopter traffic and search and rescue (SAR) flights.

In addition to urging all operators and vessel owners on the NCS to show increased vigilance in this context, the PSA monitored developments and maintained a close dialogue with the companies and the relevant authorities. The drone observations were investigated by the Norwegian Police Security Service (PST) and the police.

Furthermore, the PSA has urged the industry to collaborate closely with the authorities, between the authorities and the companies, between the companies, and between employers and employees.

Openness and information-sharing are important in work on health, safety and the environment (HSE) because this lays the basis for learning and improvement. The same also holds true for work on societal safety and security.

Even though information may be confidential, a lot can be shared and the PSA’s basic view is that the industry must share data where possible. It is important to ensure openness – without exposing vulnerabilities.

One of the PSA’s prioritised security activities is its one-day seminar on the subject. The topic for this event in 2022 was how the present threat picture was to be understood, and what it means for management and the need for a security culture.

Results

The new security policy position means that safeguarding petroleum operations has attracted greater attention and a higher priority from both the government and the industry. So it is positive that the PSA’s supervisory activities and meetings in 2020-21 show that progress has been made over the years by the security discipline.

While the level of maturity in this subject has increased, a number of nonconformities were identified by the authority in 2022. These will be followed up in future supervisory activities.

Control of petroleum production on the NCS and gas transport by pipeline to Europe were identified by the Norwegian government in 2022 as basic national functions. Following the attacks on the Nord Stream 1 and 2 pipelines in the Baltic during September that year, Nato has reached agreement on increased surveillance in the North Sea and a strengthening of work on protecting critical infrastructure – including oil and gas pipelines.

In light of the changed threat picture, the government has instituted measures to sharpen emergency preparedness related to infrastructure, land plants and facilities on the NCS. Sharing of information and intelligence has also been strengthened.

Effects

Both the government and the authorities have contributed to strengthening barriers which protect infrastructure and gas transport against deliberate attacks. Section 9-3 of the Petroleum Act requires licensees to initiate and maintain security measures to help avoid deliberate attacks on facilities and to have contingency plans at all times for dealing with such assaults.

The overall security of the petroleum sector thereby comprises the sum of measures implemented and maintained by the players and the authorities.

Through risk-based supervision, follow-up of security incidents and meetings, the PSA has helped to improve the security status of the players. It has also contributed to national emergency preparedness and crisis management by providing input to the position picture for the sector and the nation.

That has created a better decision basis for dealing with the position, collaboration on implementing measures, and following up both the players and the contribution to the country’s total defence.

This article is taken from PSA's annual report for 2022. The full report (in Norwegian only) can be read here.