Saudi Arabia - An object lesson in the importance of guarding against low-tech threats
19 September 2019
The drone attacks on Saudi Aramco’s oil and gas facilities and key infrastructure will have significant ripple effects in the global energy and petrochemical markets, as well as the global economy, as oil prices rise and natural gas production is disrupted. The strikes on 14 September hit the Khurais oilfield and Abqaiq, the world’s largest crude oil and natural gas processing site.
Aramco initially took half its oil production - about 5.7m barrels a day - offline. On 17 September it said in a statement that crude oil processing at Abqaiq was running at 2m bbl/day and that output is expected to be restored to prior rates by the end of September.
This is the latest in a string of incidents targeting Saudi facilities that should serve as a warning to governments and critical infrastructure operators worldwide of the potential for backdoor and low-tech attacks from hostile state and criminal actors.
The Aramco attacks have been been claimed by the Iran-backed Houthi movement, the rebel movement fighting Saudi-led forces in the Yemeni Civil War.
The USA and Saudi Arabia have blamed Iran for the strikes. Even the French Government, which has tried to mediate between Iran and the USA, said on September 19 that the claims by Houthi rebels were "not very credible", inferring that Iran had overall responsibility for the attacks.
Iran denies arming the Houthis and says it played no part in the recent strikes. President Hassan Rouhani said the attacks were carried out by “Yemeni people” in response to the Yemen war.
Previous incidents have included a series of explosive blasts on tankers in Gulf waters, including two Saudi vessels in May, and attacks on other Saudi oil assets, including two oil pumping stations. A transformer station near a desalination plant in Shuqaiq in the south was struck in June.
Hostile state actors are also thought to be behind an attempted cyber-attack on a Saudi petrochemical plant in 2017, the second time so-called Triton malware had been found in a Saudi facility.
The previous attacks caused limited damage, but the strikes on Abqaiq and Khurais knocked out 5% of the world’s oil production capacity.
Saudi Arabia has US-supplied Patriot anti-missile systems that have shot down a number of incoming ballistic missiles at high altitude, but the destruction at the two refineries illustrates how vulnerable the country’s oil (and other) infrastructure is to relatively low-tech drones, which the Houthis have in abundance.
Billions of dollars spent by Saudi Arabia on cutting edge Western military hardware has not so far included equipment to shoot down drones and cruise missiles, which can fly beneath the radar and are consequently difficult to detect before they hit their target.
The United Nations says the Houthis’ arsenal includes anti-ship cruise missiles, waterborne improvised explosive devices, ballistic and cruise missiles and rockets, as well as weaponised drones, according to a Reuters report. A new type of Houthi drone appeared in mid-2018 which the UN has said can fly up to 1,200-1,500 km - putting many Saudi cities and oilfields within range.
Although Saudi Arabia is involved in hostilities with some of its neighbours, this does not mean that countries in more peaceful corners of the globe will not face similar threats in future. The Saudi experience should be a wake-up call.
It has taken years since the first threats appeared for energy producers and utilities to put in place adequate cyber protection. Now, they face a new menace. When a cheap drone with a thermite grenade can destroy large sections of a multi-billion dollar plant, governments and critical infrastructure operators would be well advised to put in place effective countermeasures to protect their facilities from threats of this nature.