157 CDS 08 E rev 1 - Energy Security: Co-operating to Enhance the Protection of Critical Energy Infrastructures
Rapporteur: Lord JOPLING (United Kingdom)
TABLE OF CONTENTS
II. PROTECTING CRITICAL ENERGY INFRASTRUCTURES: A COMPLEX CHALLENGE
III. ENHANCING CRITICAL ENERGY INFRASTRUCTURE PROTECTION THROUGH INTERNATIONAL CO-OPERATION
APPENDIX 1: INTERDEPENDENCIES IN THE ENERGY SECTOR
APPENDIX 2: NUMBER OF OIL AND GAS INCIDENTS IN SELECTED COUNTRIES
APPENDIX 3: MAP OF MAJOR OIL FLOWS AND CHOKEPOINTS
1. Energy security, which is generally defined – from the consumer's point of view – as access to adequate, affordable and reliable energy supplies, has become a matter of growing concern in Europe and North America in recent years. Most states in the Euro-Atlantic region are far from full energy independence, and rely on resources located abroad, often in faraway and unstable regions. They are therefore dependent on a series of external developments, some of which have recently indicated worrying trends.
2. The first of these is the evolution of the global energy market. Current projections indicate a trend towards an increasingly tense market in the coming decades, due, in particular, to a soaring demand in developing countries, which is expected to account for 74% of the overall increase in the global energy demand between 2005 and 2030. The International Energy Agency (IEA) estimates that the global energy demand will increase by more than half by 2030 compared with 2005. Additionally, studies by the IEA confirm that the current course is not sustainable, given global objectives to reduce CO2 emissions.
3. Second, fears of a political use of energy resources by supplier states have also been revived by several recent events in the former Soviet Union. Third, there are indications of a growing threat of terrorist attacks on energy infrastructures, the effects of which would be felt worldwide. Tensions in the global energy market only increase the attractiveness of energy infrastructures to terrorists.
4. Because energy goes to the very core of a state’s interests and survival, energy security is a vital issue for NATO Allies individually. At the Riga Summit in 2006, allied governments have also tasked NATO to consider its potential role in enhancing energy security collectively. The outcome of this reflection was examined at NATO’s Bucharest Summit in April 2008, where Heads of State and Government agreed on a number of principles and fields for NATO’s role in energy security.
5. The NATO Parliamentary Assembly (NATO PA) certainly has a role to play in fostering reflections and discussions on NATO’s potential role in enhancing energy security. Past initiatives include an excellent report presented by Jos van Gennip, (Netherlands), General Rapporteur of the Economics and Security Committee in 2006 [170 ESC 06 E rev. 1], and Resolution 354 of 2006 on “Improving Global Energy Security”. This year, the Science and Technology Committee (STC), via its Sub-Committee on Energy and Environmental Security (STCEES), has taken the lead on this issue and will be discussing a report by Mario Tagarinski (Bulgaria) on “Energy Security for the Euro-Atlantic Region” [168 STCEES 08 E], which provides a comprehensive overview of the challenges and possible responses. Your Rapporteur would also like to mention the upcoming report by Vahit Erdem (Turkey), Rapporteur of the Mediterranean and Middle east Special Group (GSM), which will examine energy issues in the Mediterranean.
6. This report will focus on disruptions of the supply chain, which involve a physical attack against energy infrastructures through acts of terrorism and other forms of violence. These threats are addressed mainly through what is referred to as critical energy infrastructure protection (CEIP), that is policies which aim to reduce the vulnerabilities of the critical energy infrastructure in order to minimize the probability and potential impact of a successful attack. CEIP is a specific, but important, aspect of enhancing energy security. In fact, it is one of the tasks mentioned in NATO’s Bucharest declaration.
7. The report will not examine disruptions connected to accidents and natural disasters. Nor will it consider disruptions resulting from decisions made by supplier states or companies which do not involve the use of violence, such as supply reduction or cut-off, price increases, embargoes, etc. Politically motivated energy supply disruptions are a real and serious concern, and several NATO nations – particularly those that are highly dependent on one gas supplier – consider that they pose a more direct and immediate challenge than physical attacks against energy infrastructure. However, your Rapporteur would like to draw a clear distinction between these two types of challenges. Addressing physical attacks against energy infrastructure requires entirely different policy tools than addressing the threat of politically motivated energy supply disruptions. This report was always intended to focus exclusively on the former. This is not to downplay the seriousness of other threats. Rather, this report is an attempt to bring some clarity into the discussion on energy security, which too often mixes together arguments relating to very distinct aspects of the question.1
8. This year’s report will build on the special report on “The Protection of Critical Infrastructures” [162 CDS 07 E rev. 1], which your Rapporteur presented to the Committee on the Civil Dimension of Security (CDS) in 2007, and which provided an overview of efforts undertaken by governments in Europe and North America to address the vulnerability of their infrastructure to acts of terrorism and other threats in a number of key sectors, including the energy sector.
9. The report first examines the nature of the challenge posed by terrorism and other violent acts to energy supplies in Europe and North America. It then examines the value of cooperative efforts in addressing this challenge. Overall, the report argues that the threat of attacks on the energy infrastructure is real and that there is a case for a greater role of NATO and the European Union in addressing it.
10. The energy sector relies on a large number of diverse categories of infrastructure, which make up all the different components of the energy chain. These include infrastructures for the extraction, production or generation of energy, infrastructures for land and maritime transport, for processing and refining, for storage, distribution, etc.
11. The energy sector also includes several sub-sectors – gas, oil, coal and electricity –, each with its specific infrastructures. For instance, infrastructures for electricity production include facilities based on gas, oil, coal, hydropower, nuclear power, wind or other sources. In terms of protection needs, electricity is generally considered a more diversified, and, therefore, less attractive, sub-sector for terrorists, whereas the oil sector is more attractive, because of the high dependence of developed countries on foreign oil, mainly for transportation.
12. This diverse set of infrastructures makes for a very complex picture. To take just a few examples, according to the Department for Business Enterprise and Regulatory Reform, the United Kingdom has 19 nuclear reactors, 108 oil installations, 180 gas platforms, 14,000 km of oil and gas pipelines, 9 major oil refineries, and 1,966 wind turbines on its territory. According to the Energy Information Administration, the United States in comparison has 104 nuclear power plants, some 5,000 electricity power plants, 149 oil refineries, some 2 million miles of oil pipelines and 300,000 miles of gas pipelines.
13. Of course, not all infrastructures in the energy sector are critical. As stated in the Committee's 2007 report, “critical infrastructure is generally understood as those facilities and services that are vital to the basic operations of a given society, or those without which the functioning of a given society would be greatly impaired.” Most countries use a definition based on “the severity or effects of the disruption or destruction of a given infrastructure on society (i.e. the infrastructure is critical because its loss would be extremely disruptive).” The degree of disablement – of the infrastructure itself, as well as of other infrastructure, services and sectors that depend on it – is thus an important element in assessing criticality. Other important elements are the duration of the disruption and the cost of restoring the infrastructure.
14. In this regard, one important feature of the energy sector is the interdependence of its energy infrastructures2, as well as the dependence of other sectors on energy. This means that the energy sector as such is uniquely critical for a country, and consequently, an extremely attractive target for terrorists.
15. Additionally, the energy sector relies on a global chain of interdependent infrastructures. This adds another layer of complexity. Most NATO countries are major net importers of energy. The United States imports approximately 60% of its oil. Europe imports half of its primary energy sources, and this figure is expected to increase to more than two-thirds by 2030. Indeed, the European Commission estimates that by 2030 the EU would import over 90% of its oil and 80% of its natural gas. Both Europe and North America thus come towards the end of the energy chain, at least in the major sub-sectors of oil and gas. This means that they are dependent on the whole series of energy infrastructures, which comes before them in the supply chain. Many of these are located abroad. For instance, it is estimated that half of the proven oil reserves are located in the Middle East and 70% of the proven natural gas reserves are concentrated in the Middle East and the former Soviet Union (Iran and Russia alone account for some 40%). This means that a major oil facility in Saudi Arabia could be considered as a critical energy infrastructure for the United States or for Europe.
16. In other words, energy infrastructures that are critical for Europe and North America include not only major infrastructures located on their territory, but also a host of infrastructures located abroad. Ensuring secure energy supplies to Europe and North America thus necessitates the protection of major energy infrastructures at all stages of the supply chain and in all the countries hosting these infrastructures. As is highlighted in section C below, infrastructures located in third countries are generally more attractive to terrorists, precisely because they come at the beginning of the supply chain, which means that an attack on these infrastructures would have major cascading effects. It is thus for these infrastructures that the need and the incentive to adopt a cooperative approach are greatest.
17. Following this argument, this report will not review national CEIP programmes in NATO countries and will only tangentially deal with critical energy infrastructures located in these countries. It will rather focus on global interdependencies and the potential role of NATO and the EU in addressing the threat of terrorists taking advantage of these interdependencies to target Europe, North America and their allies.
B. ASSESSING THE THREAT TO CRITICAL ENERGY INFRASTRUCTURES
18. The following two sections will attempt to provide some elements for assessing risk to critical energy infrastructures from the point of view of North American and European consumer states. As mentioned in our 2007 report, “risk is generally defined as a factor of the likelihood of a threat to the infrastructure, of vulnerability of this infrastructure, and of the expected consequences or impact on the infrastructure, should that threat materialise”. In other words, assessing risk means determining the likelihood of a particular attack being successful and its potential consequences. Protection measures will generally focus on high-risk events, i.e. threats that are likely to materialise and that would have serious consequences. For lower-risk events, it is important to determine what is considered as an acceptable risk. For instance, an event can be likely, but have very limited consequences, or on the contrary, be very unlikely, but have catastrophic consequences. It is then a political decision to determine whether such a level of risk is acceptable or not.
The terrorist threat
20. The attractiveness of the energy infrastructure to terrorists is a result of the characteristics mentioned above – interdependence of energy infrastructures, dependence of other vital services and sectors on energy, dependence of Western economies on energy infrastructure located in unstable regions. Even though an attack on a major energy infrastructure might not necessarily cause many victims – though this obviously depends on the target -, the economic cost and disruption are likely to be enormous. In fact its impact can be amplified several times disrupting the targeted infrastructure; having a cascading effect on other energy infrastructures downstream as well as on other sectors of the economy; having a psychological impact upon and being amplified by the media; and potentially causing an overreaction of financial markets. In fact, some analysts point out that the current price of oil on the world market already includes a “terrorism premium”, that is an additional cost connected to the losses incurred because of past attacks and the anticipated losses from future attacks. One analyst suggests that the price of the oil barrel has already increased by US $30 only as a consequence of attacks on the energy infrastructure in Iraq.3
21. The attractiveness of the energy infrastructure to terrorists is likely to increase if the projected trend towards a growing imbalance between supply and demand in the energy market is confirmed. In fact, the more strained the energy market, the greater the potential impact of an attack.
22. Several major terrorist figures, including senior Al-Qaeda representatives, have clearly expressed their intention to strike global energy markets in order to “bleed America to bankruptcy”, according to a phrase attributed to Osama Bin Laden. In an audio message from December 2004, the Al Qaeda leader had explicitly called for attacks in the Gulf region and in the Caspian Sea. His deputy commander, Aydan al Zawahiri, as well as the operational commander for the Gulf region and alleged specialist in maritime operations, Rahim al-Nashiri, are also known to have called for strikes on major oil targets in Muslim countries.
23. In Turkey, the PKK has also stated its intention to target economic interests, and has claimed responsibility for several incidents involving energy infrastructure, including a recent explosion at a pumping station on the Turkish portion of the Baku-Tbilisi-Ceyhan (BTC) pipeline on 5 August 2008, which killed nine Turkish soldiers and forced the pipeline to be shut down for over two weeks. Turkish authorities have refuted the terrorist nature of this incident. Nevertheless, the potential threat of PKK terrorism cannot be totally excluded, and raises the issue of the protection of the BTC pipeline.
24. Terrorists have also demonstrated their capability to attack energy infrastructures worldwide, although not all plots have been successful.4 To date, attacks have included attempts to damage tankers or disrupt loading operations in or near overseas ports. Examples include a suicide boat attack on the French supertanker Limburg off the coast of Yemen in October 2002, which killed 1 person, injured 17, and spilled 90,000 barrels of oil, and the failed attack with explosive-laden vehicles on the Abqaiq oil processing complex in Saudi Arabia (which, with more than 6 million barrels a day, is the world’s largest oil refinery) on 24 February 2006. It is also estimated that some 550 attacks on energy infrastructure have taken place in Iraq since 2004. The Worldwide Incidents Tracking System of the US National Counterterrorism Center reports over 1,500 terrorist incidents targeted at or involving the energy infrastructure worldwide between 2004 and 2008. These incidents are evidence of a real threat. Although catastrophic scenarios have so far been averted, it would be unwise to write them off. In fact, had the Abqaiq attack been successful, it would have certainly come close to a catastrophic scenario.
26. Although very different in nature from terrorist threats, the impact of other politically motivated attacks on energy infrastructures cannot be ignored. In this regard, local insurgency movements in Nigeria and Columbia have caused particular concern in Western capitals. In Nigeria, which is the 8th largest energy supplier, insurgents of the Movement for the Emancipation of the Niger Delta and other armed groups are fighting to gain control of the oil revenues and expel foreign oil companies. In 2006, they carried out attacks and acts of sabotage, which reduced the oil output of the country by some 25%. Overall, it is estimated that the global oil market loses over one million barrels per day due to politically motivated sabotage.
27. Acts of piracy committed at sea raise yet another set of issues. Pirates are very different from terrorists, as they are not politically motivated, but seek private profit. Nevertheless, acts of piracy pose several challenges in relation to international shipments of energy. The International Maritime Bureau records some 300 acts of piracy every year, mostly in South and Southeast Asia, some of which have targeted oil shipments. The recent increase in the number of acts of piracy off the coast of Somalia has prompted renewed international attention in this problem, and led both NATO and the EU to consider direct involvement in the protection of shipments of humanitarian assistance to the region. Some experts have also raised fears of a nexus between terrorism and piracy on the world’s high seas. A recent study by Martin Murphy of the University of Reading6 downplays the risk of such a collusion of interests, pointing out that, so far, links have only been indirect, with terrorist groups in South and Southeast Asia using piracy to raise money for their cause. However, the possibility of terrorist groups seeking to develop links with local groups involved in acts of piracy in the future cannot be totally excluded.
C. IDENTIFYING VULNERABLE CRITICAL ENERGY INFRASTRUCTURES WORLDWIDE
28. The following section, rather than reviewing all possible scenarios, will focus on a number of infrastructures generally considered as particularly attractive for terrorists. It is reasonable to believe that the most likely targets are the ones that are most vulnerable and the destruction of which would have the most devastating consequences. Sources of vulnerability can be manifold; experts generally distinguish between physical vulnerability (access to the infrastructure, intrinsic characteristics and design of the infrastructure that make it vulnerable), human vulnerability (in particular the risk of an insider planning or participating in an attack against the infrastructure), and IT vulnerability (the risk of a failure in computers or in the communications system). Consequences can include human casualties, the damage done to the infrastructure, the environmental impact, but also the disruption caused by the attack to the energy flow, to the economy at large, and to the society in general. It can be quite difficult to establish which of these consequences terrorists are most likely to seek, yet determining the terrorists’ motivations is essential in assessing vulnerabilities and addressing them. It is reasonable to believe that terrorists would target large-capacity infrastructures. However, Al-Qaeda in particular has also shown an inclination for symbolic targets, the destruction of which would have an important psychological – if not human or economic – impact.
29. The oil infrastructure is generally regarded as the most likely target, due to both the high dependence of North American and European countries on foreign oil, and the concentration of resources in a relatively small number of countries. Oil is also a global commodity, and the impact of an attack on oil infrastructures could therefore be felt worldwide. In contrast, the gas and electricity sectors rely on regional infrastructure networks; disruptions would thus generally have a more localised and limited impact.
31. Past experiences show that an attack on one isolated tanker would not cause serious disruption, but could have important economic, as well as environmental costs. In a recent report, the US Government Accountability Office (GAO) calculates that tankers cost about $150 million, and the lost cargo could cost over $100 million more. The cost of cleaning the oil spill can vary greatly depending on its location; the Exxon Valdez incident for instance required a $2.2 billion clean-up operation.7 The impact on the oil market of the Exxon Valdez incident was relatively limited in the long-run, but an immediate reaction occurred. The GAO report mentions that “in the first week after the oil spill, spot market prices of unleaded regular gasoline increased by $0.50 from $0.68 per gallon to $1.18 per gallon, a 74% increase due to fears of an extended closure of oil from the Alaskan North Slope. In the following weeks, however, prices began to decrease, hitting $0.99 on 7 April (2 weeks after the spill) and $0.82 on 14 April (3 weeks after the spill). Thus as markets realized that the supply shortage would be short-lived, prices dropped sharply.”
32. Therefore, individual tankers as such cannot be considered as critical infrastructure. Most experts consider, however, that an attack on a tanker becomes a serious problem when it causes maritime traffic to be stopped for a long time and causes large losses of oil and major pollution. This is the case in particular if an attack occurs at a major maritime chokepoint. It is estimated that there are some 200 chokepoints in the world. However, only about seven of these are considered critical for the global energy supply. The two main sites are the Straits of Hormuz (through which pass 17 million barrels a day, or 20% of the world oil supply), and Malacca (with some 15 million barrels a day). Other important sites include the Suez Canal (4 million barrels a day), the Bab el Mandeb (3.5 million barrels a day), the Turkish Straits (with 2.5 million barrels a day), Gibraltar (1 million barrels a day) and the Panama Canal (0.5 million barrels a day).8
33. The GAO report highlights the potential consequences of an attack taking place in the Strait of Hormuz, and in particular the lack of sufficient oil reserves in allied countries to compensate for a disruption of supplies over an extended period of time. It states: “While there are some limited alternatives for exporting oil from the Persian Gulf without going through the strait, these alternatives could not make up entirely for the amount of oil lost by its closure. While the United States and other oil-importing countries have reserves of crude oil that they could use to mitigate the loss of supply via the Persian Gulf, oil could not be withdrawn fast enough to entirely make up the lost volumes. For example, while the US Strategic Petroleum Reserve has 688 million barrels of oil, the send-out capacity of the reserves is only 4.4 million barrels per day. Other countries face similar constraints. Additionally, if closure of Hormuz lasted for an extended period of time, strategic reserves could run out or become so low as to be unable to mitigate any additional petroleum supply disruptions.”
34. Devastating effects could also be achieved with an attack on a major port or on a tanker approaching or leaving a major port. In 2006, the US Congressional Budget Office estimated that a week-long closure of the Los Angeles-Long Beach ports, which handle 30% of US shipping imports, would cost the US economy between $65 and $150 million a day.9 The disruption could be even greater depending on the configuration of the port. Some major ports have narrow access points, which can constitute vulnerable chokepoints for maritime traffic, and are therefore potentially attractive targets for terrorists. In February 2007, this Committee visited the port of Antwerp, the second largest port in Europe for international shipping freight and the fourth in the world. Ships coming from the North Sea have to sail along a 43-mile long canal, whose width narrows down to around 0.9 mile at the entrance of the port.
Other Oil Infrastructures
36. Opinions diverge as to the seriousness of the threat of maritime terrorism directed at energy infrastructures. In 2004, the UK’s first Sea Lord and Chief of the Naval Staff, Admiral Sir Alan West, warned that maritime terrorism is a “clear and present danger” that could “potentially cripple global trade and have grave knock-on effects on developed economies”. However, only a small number of attacks has been committed so far, with a relatively limited impact. In his paper on maritime terrorism, Martin Murphy argues that attacks on land infrastructure are generally more likely than attacks at sea. However, he recognises that attacks at sea might be attractive in certain specific settings, for instance in an unregulated area affected by other forms of instability, such as acts of piracy. Most countries continue to consider attacks at sea as a major threat scenario. While previous attacks have used ships loaded with explosives, one could also imagine for instance an attack using aircraft.
37. Land oil infrastructure – pipelines and terminals – can also provide potential targets for terrorists, although only a limited number of infrastructures would actually have a global impact if attacked by terrorists. Alex Schmidt, Senior Fellow at the Memorial Institute for the Prevention of Terrorism, cites in particular the Abqaiq oil processing complex (over 6 million barrels a day) and the Druzhba oil pipeline from South Russia to Western Europe (which moves 1.2 million barrels a day over 4,000 km). 10
Liquefied Natural Gas (LNG) Infrastructures, the Electricity Grid and Others
40. Clearly, there are other energy infrastructures, the destruction of which would have major cross-border effects. However, it would not be possible to review all possible scenarios in the limited framework of this report. The interconnectedness of electricity grids in Europe and in North America for instance creates a situation where a failure in the grid would have major cascading effects. The major electricity blackout of August 2003 in North America, which affected 50 million people from New York City to Ontario in Canada, as well as the November 2006 blackout, which was triggered by a failure in Germany and ended up affecting Austria, Belgium, France, the Netherlands, Spain and Portugal, both highlights the potential impact of an attack on the electricity grid in Europe or in North America. One could also think of the devastating impact that an attack on a nuclear reactor could have. The Committee learned during its visit to the Doel nuclear power plant in Belgium in February 2007 that safety measures at nuclear power plants are strictly regulated and have been greatly enhanced; the structure of recent nuclear plants is now made in particular to withstand the impact of an aircraft. Other vulnerable nuclear infrastructure also includes, for instance, radioactive waste disposal sites. In this, as in other cases, a constant review of vulnerabilities and protection measures is fundamental, particularly as an increasing number of states consider greater use of nuclear energy as an effective means of achieving the twin objectives of energy independence and the fight against climate change.
41. The attractiveness of renewable energy infrastructures for terrorists and the potential impact of such attacks have not yet been extensively studied. According to the International Energy Agency, renewables – including hydropower, biomass, wind, solar, geothermal, tidal and wave energy – currently represent only about 10% of the world’s energy, but nations across Europe and North America have set themselves ambitious objectives to increase the share of renewables in their energy mixes. Because of the small scale of most facilities involved in the production of renewable energy, the impact of a terrorist attack on one of these facilities would probably be quite limited. Nevertheless, the increasing use of renewable energy should be accompanied by a thorough assessment of the risk and vulnerabilities of such infrastructure.
A. THE VALUE OF INTERNATIONAL CO-OPERATION
43. There are several problems or challenges connected with international co-operation in the field of CEIP. Firstly, different countries have different energy mixes, and therefore different vulnerabilities and priorities in terms of protection. For instance, while many European countries are heavily dependent on gas from Russia, and therefore put greater emphasis on securing this supply route, the United States tends to focus more on oil supplies from the Middle East, which they consider as their greatest vulnerability. NATO and EU countries also have diverging approaches to energy security. Some favour a market-based approach, others put greater emphasis on aspects relating to physical security and protection. This report embraces the view that there is also a military dimension to the issue, a view that is not shared by all allies. As Andrew Monaghan puts it in a recent report published by the NATO School, “[t]he EU as a whole is very diverse, but states within it are not. […] Oddly enough, if the EU as a whole was less diverse, it would be easier to formulate a common policy. But in reality, it is so diverse in terms of its routes, sources and energy types that members have real difficulties coming together and agreeing on common positions.”12 If differences exist within the EU, the picture becomes even more complex when the transatlantic dimension is added.
44. Secondly, governments are generally reluctant – and rightly so – to share information on issues as sensitive as a nation’s vulnerabilities to terrorist attacks. Last year’s special report put great emphasis on the need to ensure the full confidentiality of any information exchange in the field of critical infrastructure protection. This point cannot be emphasised strongly enough. Recognising that full security and confidentiality are not always possible, section B below stresses the inadvisability of preparing an EU inventory of national critical infrastructures in member states.
45. Thirdly, private companies are also important stakeholders in the energy field. They own and operate a great share of the world’s energy infrastructure, and are therefore primarily responsible for its protection. While production facilities tend to be primarily dominated by state bodies (it is estimated that 78% of oil production and 74% of gas production is under state control), private companies are more present as far as transportation is concerned. For instance, 80% of tankers are privately owned. Any framework for international co-operation thus needs to take into account the role of private companies in the energy field and find ways to engage with them.
46. Obviously, the protection of critical infrastructures is primarily a national responsibility, and all countries in Europe and North America have developed policies to protect energy infrastructures located on their territories. However, the distribution of the world’s energy resources means that Europe and North America are major consumers of energy, which mostly originates in third countries. In this sense, their energy supplies rely on infrastructures located abroad, in supplier and transit countries, as well as international spaces. Europe and North America thus have a common interest in ensuring that the whole supply chain is equally well protected against acts of terrorism.
47. Several countries have developed national strategies aiming to promote the protection of infrastructures located in third countries through bilateral, regional or multilateral initiatives. The United States, for instance, adopted in April 2006 a “global critical energy infrastructure protection strategy”, and is already actively engaged in bilateral and multilateral initiatives to secure the protection of energy infrastructures located abroad that are considered critical for US energy supplies. For instance, the US Department of Defence is in charge of a $227 million programme aimed at enhancing the physical protection of oil, water and electricity infrastructure in Iraq.
48. It is reasonable to believe that major oil infrastructures in the Middle East considered critical for the United States are critical for most of Europe and Canada as well. In this sense, a coordinated approach seems appropriate, and would also allow for a sharing of protection costs. The Institute for the Analysis of Global Security reports for instance that the cost of defending the sea lanes of communication and providing military assistance to partners in oil supplying nations costs the United States alone some $50 billion per year.
49. Your Rapporteur is convinced that international co-operation can complement national policies and private sector initiatives and help fill protection gaps in three main areas. First, international co-operation can further a better understanding of the nature and extent of the threat. Second, it can help reduce vulnerabilities at home through the co-ordination and harmonisation of national CEIP policies, and abroad through joint efforts to enhance the physical protection of critical infrastructures in supplier and transit countries as well as in international spaces. Thirdly, international co-operation can help reduce the consequences of an attack should it occur. The more limited the impact of an attack on a particular infrastructure, the less attractive this infrastructure is for terrorists. Minimising the potential impact of attacks on critical energy infrastructures can thus also contribute to reduce the likelihood of such attacks.
50. A number of co-operative initiatives at the bilateral and multilateral levels already exist in these three areas. Discussions on energy security in several major international fora have raised awareness of the threat and fostered consensus on the need to enhance protection policies across the globe. Thus, the G8 Summit in Saint Petersburg in 2006, devoted to global energy issues, emphasised, among other priorities, the need for international co-operation to enhance the physical protection of energy infrastructures worldwide.
51. Important measures have already been taken to reduce vulnerabilities in several subsectors. The protection of nuclear power plants is a case in point. In this field strict national and international regulations already exist, in particular under the auspices of the International Atomic Energy Agency (IAEA). Maritime security has also been a major priority for international efforts. A landmark document in this regard is the International Ship and Port Facility Security Code (ISPS) adopted in the framework of the International Maritime Organisation (IMO) and ratified by 148 countries. This code went into effect on 1 July 2004 and requires all port facilities and vessels to create and submit a security assessment and plan to address vulnerabilities. Any ship not meeting this standard can be denied entry into any participating country. An EU directive of October 2005 incorporates and builds upon the provisions of the ISPS code.
52. Other co-operative initiatives aim more broadly at building resilience in the event of a major disruption of the energy market. In this sense, they go beyond the mere physical protection of infrastructures and contribute to the broader goal of enhancing supply security. These policies include, in particular, measures aiming at the diversification of energy sources and transportation routes; energy efficiency; the constitution of emergency stocks; and emergency planning and response.13 By reducing the dependence on one specific energy source or one supplier, building redundancy, and generally enhancing the ability to respond to disruptions should they occur, these measures reduce in turn the attractiveness of energy infrastructures to terrorists.
53. The following section will focus specifically on the possible contribution of NATO and the EU to CEIP.
B. THE ROLE OF NATO, THE EU AND ISSUES OF CO-ORDINATION
55. However, the evolution of the energy market and the awareness of new threats have prompted a reassessment of NATO’s possible contribution in this area. Existing initiatives have been grouped together under the heading of NATO’s role in energy security, and new potential areas of intervention have been considered. At the Riga Summit in 2006, Heads of State and Government called for a “co-ordinated, international effort to assess risks to energy infrastructures and promote energy infrastructure security”. They tasked the North Atlantic Council (NAC) to define “those areas where NATO may add value to safeguard the security interests of the Allies”. This renewed focus on energy security was also integrated in the Comprehensive Political Guidance adopted in Riga, which cites “instability due to (…) the disruption of the flow of vital resources” as one of the main likely risks or challenges for the Alliance in the next 10 to 15 years.
57. Based on these developments and taking into account the recognition at Bucharest of NATO’s role in supporting CEIP, NATO can be expected to play a greater role in a number of related areas. One such area is promoting a convergence of views among Allies as to the nature and seriousness of the threat to critical energy infrastructures worldwide. This will be done through consultations, as well as exchanges of information and intelligence, among NATO Allies, but also through dialogue with partner countries. NATO is developing partnerships with an ever-greater number of countries all over the world, including in the regions crucial in terms of energy flows – the Middle East, North Africa, and the former Soviet Union. Promoting a closer dialogue on threats to global energy infrastructures as part of NATO’s partnerships would certainly benefit both sides. A lot more could be done in particular in the framework of NATO’s partnerships with Mediterranean and Gulf countries. NATO’s structures also allow for a dialogue with the private sector. Using these to address issues relating to the security of energy infrastructures would also be very useful. Finally, NATO could enhance dialogue with other relevant international organisations, such as the IEA, the IAEA, the UN, the EU and others.
58. Related to this is NATO’s potential role in enhancing the surveillance of energy flows, particularly at sea. As a matter of fact, NATO, through its headquarters in Northwood and Naples, already has a structure in place which can help develop greater “situational awareness”, that is; to have a clear picture of where important shipments are at any given time. NATO’s Operation Active Endeavour already serves a similar purpose in monitoring the movement of ships in the Mediterranean to deter terrorist activities. NATO is also considering plans to make greater use of its Standing Maritime Group 1, which forms the naval component of the NATO Response Force.
59. NATO could also foster the exchange of best practices among Allies. A useful initiative in this regard could be the establishment of a NATO Centre of Excellence for CEIP, following the model of the Co-operative Cyber Defence Centre of Excellence in Estonia. The latter can best be described as a research and learning centre where best practices are developed and shared. The centre’s main tasks include providing doctrines and concepts for the Alliance in this emerging field; hosting and conducting training for NATO countries through workshops, courses, and exercises; conducting research and development activities; studying past or on-going attacks and drawing up lessons learned; and providing advice, if asked, during on-going attacks. All these tasks are as relevant in the field of CEIP as they are in the field of cyber-defence.
60. A more direct role would be in providing technical assistance and training to third countries to enhance the protection of critical energy infrastructures on their territory, as well as promote regional and multilateral initiatives to this effect. Here again, NATO can expand on the existing menu of partnership activities that it has developed with a large number of countries.
61. A fourth and more sensitive area of potential NATO involvement is the direct protection of certain sites or transportation routes. This does not mean NATO troops protecting pipelines and chokepoints on a permanent basis. Such a prospect would be unacceptable, not only to affected countries, but to many Allies as well. Rather, one could imagine that, in response to a specific threat, and upon request, NATO could be tasked to deploy a small contingent to protect a specific critical infrastructure in an allied or a third country or, more likely, in an international space. NATO’s recent decision to assist with the protection of shipments of international aid off the coast of Somalia against piracy could provide an interesting case study for examining the prospect of similar types of operations in the event of a specific threat directed at oil or LNG shipments.
62. One could also imagine that, should NATO troops be deployed in a theatre of operation where there is a clear threat to energy infrastructures, Allies might want to extend the operation’s mandate to include assistance to local authorities in protecting critical energy infrastructures. An often cited example in this respect is the participation of NATO states in Operation Earnest Will during the IranIraq war in the 1980s. The goal of this operation was to protect tanker traffic in the Gulf following several attacks by both Iran and Iraq against neutral oil tankers. NATO’s preventive role in securing critical energy infrastructures in the theatre of operations and in the maritime environment (including Allies’ territorial waters) are, in fact, mentioned explicitly in postBucharest documents. With regard to these types of operations, which might require quick reactions and specialised resources, the NATO Response Force could serve as a useful instrument.
63. Finally, a fifth task, and one which NATO is already involved in, is securing energy supplies for its own forces and facilities. This was one of the rationales for the NATO pipeline system, and it remains a relevant objective today. In the future, NATO member states might also consider how new technologies can allow them to diversify the sources of energy used for their militaries. For instance, there have been interesting discussions in the US Congress about coaltoliquid technology and its potential use for aviation. Other member states and NATO should be encouraged to monitor developments in this field.
64. These scenarios belong in different categories and imply various levels of involvement by NATO. Most of them envisage an indirect role, focusing on assistance and sharing of information, experience and expertise; others imply NATO’s direct protection of critical infrastructures. A second distinction can be made between, on the one hand, those initiatives that NATO can undertake under normal circumstances and on a permanent basis (e.g. assistance programme, co-operation with partners), and on the other hand, occasional and exceptional initiatives, taken in response to a specific threat or in the framework of an existing operation.
65. A third, important distinction is between those activities that have a military component and the others. Many Allies remain very wary of any suggestion that the military should have a role in energy supply security. Your Rapporteur would argue the contrary. It should be clear that no one is calling for a standing NATO force, charged with protecting pipelines, tankers and refineries around the world. However, this report argues that NATO’s military know-how and capabilities can provide an added value in the specific scenarios outlined above.
66. While the different proposals listed above are primarily preventive measures, several suggestions have also been made about NATO’s potential role in responding to a major disruption of energy flows. One aspect of this question is how the immediate consequences of an attack are dealt with. This is a relatively uncontroversial question, which relates to civil emergency planning and consequence management. Previous reports of this Committee have examined NATO’s role in this field and, in particular, the role of the Euro-Atlantic Disaster Response Coordination Centre (EADRCC) in co-ordinating assistance in the event of a major disaster. Although the EADRCC mechanism has never yet been activated in response to a terrorist attack, one could imagine for instance that it could be called upon to deal with the consequences of an attack on an oil supertanker causing a major oil spill. The EADRCC also provides a useful framework for training NATO and partner nations to respond to emergencies involving energy infrastructure.
67. A more controversial question is what NATO’s role would be in the event of an ally falling victim to a voluntary disruption or interruption of its energy supplies. Several prominent figures, including Senator Richard Lugar of the United States, have suggested that energy should be covered by the solidarity clause in article 5 of the NATO Treaty. This would mean that an attack against one ally’s energy supplies should be considered as an attack against all allies, triggering the activation of article 5. A similar argument was made by Estonian authorities in reaction to the series of cyberattacks on Estonia in the spring of 2007; it was then argued that Alliance solidarity should cover instances of cyberwarfare. Senator Lugar’s argument is not that NATO should intervene militarily in response to an attack or an energy cut-off directed at one of its members, but rather that the Alliance should have a mechanism in place for re-supplying any of its members. In this regard, other experts have suggested that NATO should have a role in managing emergency stocks. However, no consensus has emerged so far on this issue, and other organisations, such as the IEA, already have mechanisms in place to this effect.
68. This overview illustrates that there is a role for NATO in enhancing the protection of critical energy infrastructures. It is fairly clear that NATO should not and will not play a leading role in this field. The primary responsibility will remain with national authorities. At the international level, other specialised organisations – the IEA, the IAEA, the IMO – are better placed and equipped to develop initiatives in their respective fields of activity. However, the discussion initiated at the Riga Summit and developed at the Bucharest Summit is useful to identify those areas where NATO can add value to existing efforts, and thereby help fill protection gaps. It has already helped align the diverging points of view of NATO Allies, and in particular bridge the gap between those who see a direct role for NATO in protecting critical infrastructures and those who stress that this task is and should remain primarily a national responsibility. Nevertheless, numerous disagreements remain regarding: intelligence-sharing; NATO’s possible responses to politically motivated disruptions of energy flows; NATO’s role in the management of emergency stocks; the need to discuss energy security issues with North African and Middle Eastern partners within NATO, etc. NATO Allies need to continue their consultations on all these issues.
70. As explained in the Committee's 2007 report, the European Commission presented a proposal for a Directive on the identification and designation of European Critical Infrastructure (ECI) in December 2006. This was meant to be the first milestone towards a new EU policy for the protection of critical infrastructures. The directive aimed to establish common procedures for the identification and designation by member states of ECI located on their territory, as well as a common framework for assessing the need to enhance their protection. ECI is defined as those “critical infrastructures the disruption or destruction of which would significantly affect two or more member states, or a single member state if the critical infrastructure is located in another member state”. The directive included a provisional list of 11 critical infrastructure sectors (including energy), which were further divided into 29 sub-sectors.
71. Building on this document, another Communication of February 2007 on Protecting Europe’s Critical Energy and Transport Infrastructure proposed criteria for the identification of European Critical Infrastructure in those two sectors. Additionally, the European Commission's Green Paper on Energy of March 2006 also identified supply security as one of the objectives of a European energy strategy. The Commission proposed, in particular, the establishment of a European Energy Supply Observatory to identify infrastructure vulnerabilities and of a European Centre for Energy Networks to promote information exchange and the establishment of common standards for energy infrastructure.
72. The ECI directive was submitted to the European Parliament, which suggested a series of drastic amendments. In June 2008, the EU Council adopted the final draft of the directive, which is a very watered-down version of the Commission’s proposal. First, the directive is circumscribed to two sectors – energy and transportation. Other sectors might be included later following a review of the implementation of the directive. Second, the definition of ECI is modified to include only those infrastructures the disruption or destruction of which would affect significantly at least two member states. Third, responsibility for both pillars of the directive - the identification and designation of ECI, and the assessment of protection needs – has clearly shifted away from the Commission and to the member states.
73. The directive recognises the need for a common procedure for the identification and designation of ECI. However, national authorities are primarily in charge of identifying ECI located on their territory, as well as ECI located on another member state’s territory, an attack on which could affect them significantly. They may request the Commission’s assistance, but have no obligation to do so. Member states are then required to inform other states that may be significantly affected, and to decide in concert to designate this infrastructure an ECI. The Commission is only informed annually of the number of ECI in each member state by sector, and of the number of other states affected by each ECI. However, the exact identity of ECI is only known to relevant member states, and not to the Commission.
74. The second main pillar of the directive is a common approach to the evaluation of security requirements for the protection of ECI. The directive sets minimum requirements regarding the adoption of an Operation Security Plan and the designation of a Security Liaison Officer for each ECI. However, here again, member states remain primarily responsible for implementing these requirements and assessing the need to enhance protection. Only every two years does the Commission receive a report containing generic information regarding vulnerabilities, threats and risks by ECI sector, based on which it can assess, together with relevant member states, whether protection needs to be enhanced. The Commission may also develop common methodological guidelines for risk assessments.
75. In this latest draft, there is, therefore, no more talk of a list of ECI at the EU level, and the role of the Commission is very limited. One is almost left to wonder how the Commission will be able to ensure that member states actually follow the procedure set by the directive.
76. The changes that have been introduced into the final text of the directive should be welcomed. Many national parliaments had raised serious reservations – and rightly so – about the Commission’s initial proposals. The underlying assumption of the Commission’s 2006 directive – that there is a need to identify those elements of the European infrastructure which can considered critical at the EU level and to adopt a coordinated approach towards their protection – certainly has some value. However, the procedure proposed by the Commission, particularly the suggested establishment of a list of ECI at the EU level, has been rightly criticized, including by your Rapporteur, as it would have led to increased vulnerability, rather than greater protection. As early as February 2007, at a joint meeting with the Committee on Civil Liberties, Justice and Home Affairs of the European Parliament, members of this Committee raised strong objections to this list, highlighting the major gift that such a list would be if put in the hands of terrorists. The abandonement of this list should therefore be considered a very positive development. It should also be noted that the directive now includes several provisions stressing the need to guarantee the confidentiality of sensitive information. Although this represents an improvement upon past versions of the directive, your Rapporteur remains concerned about the declaratory nature of these provisions and the lack of specific guarantees.
77. Besides the coordination of national CEIP policies, the EU has also initiated timid efforts to develop a common external energy policy, which would include a potential role for the EU in protecting critical energy infrastructures located in third countries. The 2003 European Security Strategy (ESS) recognises the challenge posed by terrorism and energy dependence, noting that recent international developments “have increased European dependence – an, d so vulnerability – on an interconnected infrastructure in transport, energy, information and other fields”. However, the ESS stops short of proposing specific action. In 2006, in a joint document entitled “An External Policy to Serve Europe’s Energy Interests”, the Commission and the High Representative, Javier Solana, listed “enhancing physical and environmental security as well as the energy infrastructure safety” as one of the objectives for the EU’s external energy policy. However, none of their proposals addressed specifically the physical protection of infrastructures. The EU Council endorsed the joint proposal in its 2007 Energy Policy for Europe initiative. This document envisages an EU role in assisting member states that are dependent on one gas supplier, enhancing oil stock mechanisms, and addressing the problem of interconnections of electricity grids. However, it also remained silent on the issue of physical protection of infrastructure located in third countries.
78. It is interesting to note in this regard that the Commission’s 2006 ECI directive identified this as a priority for the EU, and encouraged dialogue and the exchange of best practices with specific EU partners, as well as within global institutions. However, this consideration has disappeared from the final draft, which redefines ECI to include exclusively critical infrastructures “located in the EU member states”. It is therefore unclear whether the EU will now pursue a common approach towards the protection of energy infrastructures located in third countries. This indecisiveness reflects the broader uncertainties regarding the development of a genuine external energy policy for the EU. To date, little tangible progress has been achieved in this area.
79. As this overview shows, both NATO and the EU are at a relatively early stage in defining their potential contribution to an enhanced protection of critical energy infrastructures worldwide. They have so far adopted quite distinct approaches, with the EU considering a role in the coordination of national policies, and NATO in outreach, assistance, as well as, under specific circumstances, direct intervention. As these roles are bound to develop in the near future, one priority should be to ensure that there is no duplication of efforts. This Committee has emphasised many times the need for a standing and structured dialogue between NATO and the EU in the field of civil protection. Yet, despite regular declarations of intent, not much progress has been achieved in practice. The recommendations made in past reports regarding potential areas of cooperation between both organisations thus remain valid and your Rapporteur would like to mention them once more: promoting a common understanding of the threat to energy infrastructures worldwide; engaging in a coordinated dialogue with key energy partners; fostering the development of new technologies for the protection of critical infrastructures through joint funding of science and technology programmes; and conducting combined field training exercises.
80. The parallel processes of revision of the 2003 ESS and of NATO’s 1999 Strategic Concept create an interesting window of opportunity to bring the EU and NATO’s strategies on energy security together. Your Rapporteur would like to urge EU and NATO governments, as well as both organisations, to deploy every effort in order to seize this opportunity. The new versions of the ESS and NATO’s Strategic Concept should both recognise the seriousness of the challenge for their respective member states of securing energy supplies. They should identify, in particular, the need to protect critical energy infrastructure against terrorist attacks. The parallel recognition by NATO and the EU of the nature and extent of the problem would provide common ground, on which a future dialogue between both organisations and complementary actions could later develop.
81. In conclusion, your Rapporteur would like to stress once more that protecting critical energy infrastructures is only one specific response to the broader challenge of securing energy supplies to Europe and North America. This challenge requires a comprehensive and multi-faceted approach, to include the development of an array of policies aiming to increase energy independence, better understand and reduce the threat of politically motivated or violent disruptions of energy flows, and build greater resilience in the event of such a disruption. In this context, there are many other potential areas for NATO-EU co-operation or co-ordination, which cannot be addressed in the limited framework of this report. What has been missing so far has been political will. Your Rapporteur hopes that the recent statements made by representatives of both organisations, stressing the importance of closer relations, will be followed by concrete actions. Energy security would be a good place to start.
APPENDIX 1: INTERDEPENDENCIES IN THE ENERGY SECTOR
APPENDIX 2: NUMBER OF OIL AND GAS INCIDENTS IN SELECTED COUNTRIES
See word document
See word document