Security Manager

SECURITY

SECURITY

in the Oil Industry

in

National Association of State Energy

Officials

Marty Matheson

General Manager, Pipelines

American Petroleum Institute

August 12, 2002

Significant Changes

Closer cooperation and communications

n

with government agencies

Development of industry security

n

guidelines

Long term impact of the new

n

relationships: law enforcement and the

Office of Homeland Security

Security Objectives

Energy Assurance

n

Supporting the security of domestic oil and

natural gas assets and operations

Energy Confidence

n

Maintaining the confidence of our customers,

stakeholders and the American public

Energy Responsiveness

n

Partnering with federal, state and local

agencies

President

Office of Science &

Office of Management

Technology Policy Assistant to the President

National Security & Budget

for Economic Affairs

Council

PITAC

National Science & CIO

National Coordinator

Technology Council National

NSTAC Council

for Security,

Economic Council

Infrastructure Protection and

JTRB Counter Terrorism

Infrastructure CIAO DOJ Computer crime/IP

NSIRC Tel Coordination FBI

ISAC

Group

SPACECOM DISA

DOC NTIA

SOLIC

CIAC

PCIS

JTF-CNO DOE OCIP

NSA

DTRA

IOWA

watch

Center FEMA

NIST National Labs

LIWA JCS

JPO

AFCERT CDRG

EPA

FED COOP/COG

PRE-9/11 Critical Infrastructure

Special

Intelligence

Functions

community INFRAGARD

IT ISAC NERC

Protection Organization

OIL & NATURAL GAS

INTERCONNECTIVITY

Upstream

Upstream Inbound Processing Outbound Distribution Marketing

Exploration Pipelines Pipelines

Refining Terminals Retail

Data analysis Trains Trucks

Co-generation Trucking Aviation

Drilling Shipping Barge

Liquefying Distributor Marine

Producing Ports Trading

Storage Industry

Gathering Trading Commercial

Processing Residential

Storage Credit card

Power Water Gas Telecommunications Banking Security Transaction systems

Transportation routes Computer networks Market Partners Shareholders

Suppliers Customers Consumers Contractors Employees Governments

API Security Activities

Coordinating oil industry associations

n

security coalition

Public communications on the adequacy

n

of petroleum product supplies

Responding to legislative initiatives

n

Government/industry intelligence sharing

n

Working with federal agencies; outreach

n

to state agencies

Security guidance

n

Key API Milestones

Security Guidance Document, Ver. 1,

n

approved by API Board of Directors in

March; submitted to DOE in April

API Senior Security Policy Group and

n

Infrastructure Security Committees

formed

Submitted comments on OHS alert levels

n

in April

Information Sharing

Serving as oil industry security alert

n

distribution point -- from

FBI/NIPC/DOE/DOT to hundreds of oil

companies (short term)

Supporting Energy Information

n

Sharing & Analysis Center (ISAC),

more robust long term solution

Legislative Recommendations

Legislative:

n

FOIA exemption for voluntary and

mandatory information

Liability and antitrust relief for critical

infrastructure protection

Access to law enforcement and

n

intelligence information:

Government & industry should work together

to develop a process that ensures the sharing

of relevant information

Security Guidance

Supports common goal to be

n

responsible members of the

communities in which we operate

Allows leveraging of resources

n

Reduces the likelihood of

n

legislative/regulatory solutions

Deterrence

n

Guidance Process Cycle

Oil Sector API U.S. DOE in

Segments, Cyber, partnership with Oil,

API Developed Guidance

API

Other Oil Natural Gas,

Associations & Electric

Consolidated

Energy

Lessons Building Sector

Learned & Guidance

Iterative

Experience

Audits

Public Policy Discourse

Inspections U.S. Congress

Training Office of Homeland

Education Security

Industry Usage State & Local Officials

Security Guidance

Guidance by segment for petroleum

n

Refining

Pipeline Transportation (Liquids)

Petroleum Products Distribution & Marketing

Oil & Natural Gas Exploration & Production

Marine Transportation

Cyber/IT Infrastructure

Coast Guard driving development of

n

Marine standards

ACC developed guidelines for U.S.

n

chemical Industry

Security Guidance - Goals

Guidelines, not standards or recommended

practices

Include principles, management system and

general measures to be taken at various security

alert levels

Allow flexibility based on type, size and location of

facility. No plan needed if company deems it N/A.

Allow companies to develop specific plans and keep

them confidential

Continuously refine/improve guidance as needed

Homeland Security

National Threat Advisory System

Looking to provide context and

n

texture to alerts

Five protective conditions*:

n

Severe

High

Elevated

Guarded

Low

*with respective countermeasures

OHS Alert System API Comments

API Supports Office of Homeland Security s

Proposed 5 Level Threat Alert System

Provides an effective and consistent

communication tool

Is flexible to adapt for petroleum applications

Will improve ability to reduce vulnerabilities

and respond to threats

Will standardize across Gov t Regulatory

Agencies and reduce inefficiency

OHS Alert System Add l Issues

Need to improve quality and access to

real-time threat intelligence information

Need to improve communications

between facilities and local law

enforcement and FBI

Need to address access to sensitive

information from Gov t Agencies

(i.e. FOIA, Web, RMP data)

Office of Homeland Security

Developing a National Physical Infrastructure

n

Protection Plan

Designate priority assets, systems, and infrastructure

Discuss physical protective requirements according to

sector threats, risk assessments, and

human/economic/public confidence/national defense

consequences

Identify infrastructure protection problems and solutions

Will be vetted through Congress, state and local

n

governments and private sector prior to

finalization

Due out September 30, 2002

Latest Pipeline Activities

Security guidance document

n

distributed to all operators

Worked with the Office of Pipeline

n

Safety to define

Critical facilities

Protective measures

Critical Facilities

Viable terrorist target and intelligence

n

exists that such targets are being

targeted or release has the potential for

mass casualties or significant impact on

public drinking water for major population

center

Pipeline facility that if destroyed or

n

damaged would interrupt service to a

large number of customers for an

extended period

Critical Facilities

Facility that if damaged or destroyed

n

would impair ability to serve installations

critical to national defense

Facility that if damaged or destroyed

n

would impair other modes

(transportation, telecom, electric) and

cause major economic disruption

Works In Progress

Drills with a security focus

n

Learning from drills

n

Focusing on new relationships

n

FOR FURTHER INFORMATION:

Kendra L. Martin

API Security Team Leader

American Petroleum Institute

tel. 202-***-****

*******@***.***

www.api.org

Contact this candidate