Oil field security used to mean a fence around the pumpjack. Now it can mean motion-sensitive cameras, remote monitoring, and sophisticated hardware and software analysis as well as ever-vigilant employees and managers. As oil prices rise, so does the opportunity for crimes of all sorts.

“The majority of money lost by producers is a result of organized crime at some level, and as a result of internal jobs,” says Chris White, president of Innovative Surveillance Solutions Inc., a security firm based in Tyler, Tx.

By organized crime, White says he is referring to what likely is a small-scale organization, group or gang. He says, “The majority of our work is preventing unorganized, opportunistic crime that comes from access to production facilities and construction sites.”

He notes that with oil prices holding above $100 a barrel in most places, the temptation is greater than ever.

“But we are not talking only about some crook coming onto your site to steal oil or copper pipe,” warns White. “If that thief gets electrocuted, some fancy lawyer will argue that you should have had a fence–or a better fence–to keep people away from dangerous machinery. A lot of our work is overt deterrence to mitigate liability.”

Returning to the point about inside jobs, White reiterates that the Hollywood image of a cat burglar with a black mask and cloth bag does not fit the typical oil patch theft. Very often, he says, the weak point is someone–or several someones–inside the producing or service company. He stresses that the vast majority of oil and gas industry employees are hardworking, loyal, and law-abiding. Still, even a good person can be tempted by an easy opportunity or be driven to a desperate act by difficult circumstances, White asserts.

White says the scale of loss can be large, even in simple cases. “We worked on a case in South Texas where company insiders stole more than $500,000 worth of diesel fuel in three months,” he relates.

Unfortunately, the expense of deterrence can be high, too. “The minimum to install a security system at a small site is $5,000,” says White. “That can easily run to $10,000 or $20,000.”

A large operator with 50,000 wells cannot reasonably install surveillance at all of them, White allows. That is why, he says, the most important surveillance is also internal: attentive employees and managers who can see unusual patterns or notice when something is out of line.

“In the South Texas fuel theft, it was a regional manager looking at quarterly reports who noticed anomalies in the fuel purchasing,” White recounts. “It was being (recorded) on people’s days off for vehicles they should not have been driving.”

The Human Element

As a further wrinkle, White remarks, “The biggest shocks always are the realization that good people can do bad things. The oil and gas industry is complex, and so is human nature. You may have a guy who has been a great pumper for many years, but then he gets divorced. It may put him in a bad place financially or maybe even emotionally.”

White urges his clients to be aware of any deviation from normal operations, not only regarding equipment and the flow of molecules, but also in the behavior and circumstances of employees, vendors and clients. He is not saying to be suspicious, White hedges, just alert and aware.

He also points to a bit of contract law. “If oil is stolen before it is metered, then the production company still is liable for the royalties to the owners. We have had cases where thousands of barrels were stolen, and after they were resolved, the royalty owners were due big checks. That is painful to the producer who lost the oil, but it is the law,” White advises.

One frustrating convergence of crime is in equipment, White goes on. “In a case we worked in Oklahoma, the crooks had tampered with a pump motor to cover their theft of oil,” he expounds. “The company had the pump completely rebuilt, and the crooks stole the new pump. The lead time on that stuff is about a month, so the operator either could wait a month for the new pump and lose that production, or he could buy a used pump–probably the one that was stolen.”

White describes a less clear-cut situation: “Rig bosses working for a major operator were allowing two or three hands to take 10 gallons of fuel a day off the site for their personal vehicles. At prevailing diesel prices, that was $135 a day driving off the pad. In the field, it seemed like a courtesy, but that was $1,000 a week for each rig. For 100 sites, that would be $100,000 a week driving into the sunset–half a million dollars a year.”

White says there are ways of addressing the issue. “You want your foremen to look after their tool pushers, and to them, a few gallons for a few guys is just being a buddy. But it creates a culture of theft.

“Who is paying for the fuel: the owner or the contractor?” he asks. “That is who gets to make the decision. If you want to let guys take fuel, then track it and call it part of their compensation.”

Run A Clean House

Another oil field security expert, Cliff Carpenter, attests to the internal origin of much theft from his own experiences growing up and working in the oil fields around Kilgore, Tx. That is where he says he got a “first-hand look at the skullduggery in the industry.” He has a frank assessment for how owners and operators can take a bite out of crime. “Clean up your own house first. Don’t buy stolen goods or do business with people who do,” he asserts.

Carpenter reports that diesel theft, bootlegging, and doctoring are becoming a booming business. “It seems like a lot of credit-card scammers have turned to bootlegging diesel,” he says. “Making ‘drip gas’ also is becoming very lucrative. They take condensate and additives to stretch stolen diesel. The problem is pretty bad around Houston, even at brand-name stations. In the field, stripper wells are using stolen condensate to run pumps. It is a real shame, because the thefts are putting a lot of pressure on the honest operators.”

Reiterating his theme of running a clean house, Carpenter exhorts clean operators to help investigators and law enforcement personnel find and punish the bad guys.

“Too many people find something is going on and just have the guy move on. Then it becomes someone else’s problem,” he rues. “Public companies don’t want the Sarbanes-Oxley complications of having to report the losses to regulators. Small, private operators may be afraid of being sued for giving someone a bad evaluation.”

Merely making the problem go away really just allows it to fester, Carpenter counters. “How can anyone do due diligence if no one reports a problem?” he poses. “If you catch a dishonest person, let it be known. It can be pretty obvious who the cheats are. For example, you may see a guy pull up with a new bass boat behind a big truck, and you know his wages don’t carry that.”

Producers should not look for much help from local law enforcement until the time comes to make an arrest, Carpenter cautions. “They are overloaded just dealing with drugs and violence. They can’t investigate for you if you only think something is going on,” he says.

He suggests operators work through their oil and gas associations. “Companies need to get together on security the way they do on insurance and training,” he encourages.

Carpenter notes that there are many retired law enforcement officers from all levels who could be mobilized to support oil patch security. “If companies work together, there is a lot that can be done,” he holds.

One retired law enforcement person already into oil field security is Bob Terhune, a veteran of the Oklahoma Bureau of Investigation and the Oklahoma City Police.

“It is very frustrating for us older guys to see that nobody wants to put the bad guys in jail anymore,” he laments. “Sarbanes-Oxley is a big challenge because people have to report everything to the Securities and Exchange Commission. But even at private companies, people tend to cover up stuff and move on.”

Even when a company does want to prosecute, it often makes a major mistake by going for civil damages first, points out Terhune. “If you file criminal charges, you always can make a civil claim later. If you get a criminal conviction, all you need for the civil action is the trial transcripts.”

The Digital Divide

Independent producers often are so focused on losing hydrocarbons that they overlook another danger in the electrons flying around their computers and mobile devices, warns Anthony Palmer, senior consultant at The Eli Henry Group, a 15-year-old infrastructure and data security firm based in New Orleans.

“The most prevalent threat, especially for small producers, is malware: viruses, spy ware and phishing. People who use their ordinary desktop and laptop computers and smart phones for work are especially at risk,” he says.

If a personal device is infected, an individual can replace it, Palmer explains, but business devices can corrupt important records, infect client or partner systems, or become part of a “bot net,” which he describes as someone else taking control of a computer and using it for espionage or to do damage.

“Bot nets can be used (to obtain) well or financial data, even private e-mail messages and company records,” warns Palmer. “We have seen situations where data were tainted or rendered unreliable, where proprietary technology was stolen, and where remote well-control devices were made to malfunction or fail.”

Cyber security is part of the cost of doing business today, Palmer says, but it does not have to be expensive. “An initial review and upgrade can be several thousand dollars, but after that, maintenance and support can be only a few hundred dollars a month,” he estimates.

The two best sources for information on reliable security services are either through recommendations from colleagues or associates, or through one of several professional organizations of security firms, such as Information Systems Security Association (www.issa.org), Information Systems Audit and Control Association (www.isaca.org) and the International Information Systems Security Certification Consortium (www.isc2.org).

Data Management

Charlie Pomeroy, co-founder of Houston-based Data Frontline, concurs that smaller operators are generally at greater risk to pure cyber threats than are the larger firms. The unfortunate arithmetic, he ventures, is that those most exposed are also those least able to afford full hardware and software protection. “At low natural gas prices, many operators are on the edge anyway,” he remarks.

Data Frontline is not a security firm per se, but in the course of its systems analysis and custom design, he says it sometimes comes across risks and brings them to clients’ attention. “We have seen operators using vendor software get hacked for production information,” Pomeroy says.

He notes, however, that there are risks even without malware. Many operators, from small mom-and-pops outfits to publicly traded companies, still are managing data manually, he reports. Not only does that cost time and money, it is inefficient and opaque, he contends, saying it is hard to see trends and predict outcomes looking at a page of numbers.

“Once systems are automated,” Pomeroy says, “you can connect geophysical data to accounting to well work to market information, from the wellhead to the sales point. There are so many companies that, even if they do have automated systems, have not tied their data together.”

A better view and grasp of operations enables better and more timely decisions, Pomeroy says. He recalls an instance when a pipeline owner told a large producer it needed to curtail the amount of gas flowing through a gas gathering station for long-term maintenance. The pipeline company was checking to see whether the producer had any objections.

“The client asked for a short time to check,” says Pomeroy, “The production company previously had asked us to map the flow of molecules from wellhead to the sales point. Using our mapping, the producer found that a large portion of its gas flowed through the station. The client was able to determine the appropriate wells to shut in to minimize the impact. It allowed the producer to receive more than $400,000 in what otherwise would have been delayed revenue.”

As do other vendors, Pomeroy urges producers to be aware of and address the threats, risks and challenges they face. “There are lots of good companies that provide these services,” he assures. “They are concentrated in Houston, Oklahoma City, Tulsa and Denver, but we are starting to see some in the Northeast. Some of them are new operators; others are branches of the existing players.”