Page 229 - Pipeline Risk Management Manual Ideas, Techniques, and Resources

9/206 Additional Risk Modules
An employee with intent to do harm is usually in a better posi- Leak impact factor considerations
tion to cause damage due to his likely superior knowledge of
the process, equipment, and security obstacles, as well as his It would be somewhat comforting to think that most sabo-
unquestioned access to sensitive areas. teurs are trying to send messages and cause a company
An employee with intent to do harm can be either ‘’uninten- unnecessary expense but do not necessarily want to harm
tionally acquired” or “created.” One is acquired when saboteurs innocent parties. Realistically, however, this idea should not
infiltrate the company through the normal employee hiring be a source of complacency. A saboteur in an extreme
process or as emergency substitutes for regular employees. One case might seek to use the pipeline contents as a weapon to
is created usually through a revenge motive due to a perceived create far-reaching destruction. For example, a hydrocarbon
wrong done by the company or through recruitment of the vapor cloud, allowed to reach some optimum size and then
employee by a saboteur organization. Recruitment is usually ignited, might magnify the consequences of an “unassisted”
achieved by addressing the individual’s psychological needs. pipeline leak. If the conditions are right, such an intentional
Such needs include wealth, acceptance, love, guilt, and ideals. ignition in suitable surroundings may create an unconfined
Some preventive measures are available to the operating vapor cloud explosion with the resulting damages from blast
company. Points should be awarded based on the number of effects (overpressure) and fireball thermal effects. An
obstacles to internal sabotage that exist. Common deterrents attacker could similarly wait for weather conditions that
include would enhance the spread of a cloud of toxic gases from a
pipeline release.
Thorough screening of new employees Regardless of the initial motivation for the attack, it is felt
Limiting access to the most sensitive areas that the worst case consequences are comparable to those of an
0 Identification badges unintentional pipeline release. However, the probability of
0 Training of all employees to be alert to suspicious activities. worst case consequences can be increased by an intentional
release of pipeline contents. It must be conservatively assumed
then, that in the case of sabotage, there is a greater likelihood of
D. Maintenance the consequences being more severe. This leads to the inclusion
of a factor to modify the leak impactfactor (LIF) to reflect the
Opportunities for attacks during the maintenance phase are influence of sabotage-caused leaks.
mostly already included in the operations and construction Whenever this module is used in a risk assessment, the evalu-
aspects of this index. Attention to maintenance requirements in ator should consider increasing the LIF in consideration of
the design phase, especially planning for repair and replace- worst case scenarios possibly occurring more frequently under
ment, can help to minimize the impact of attacks. These factors the threat of sabotage. If this increase is applied uniformly, it
can be somewhat addressed in the cost of service interruption. will not affect the results of a relative risk assessment unless
Variables that can also be considered in this module include pipelines under a sabotage threat are compared against those
some that are scored as part of the basic risk assessment. Their without. The LIF increase will be apparent if the relative risk
consideration here can duplicate the scoring previously or be scores are correlated to some measure of absolute risk (see
modified at the modeler’s discretion. Chapter 14).
In some cases, the LIF will include the consequences of serv-
More Significant Items ice interruption, where longer periods of interruption increase
0 Patrolling-A high visibility patrol may act as a deterrent to consequences (plant shut downs, lack of heating to homes and
a casual aggressor; a low-visibility patrol might catch an act hospitals, etc). Restoration priority can be established using
in progress. concepts from the service interruption risk, discussed previ-
Station visits-Regular visits by employees who can quickly ously in this chapter. This would show the components of the
spot irregularities such as forced entry, tampering with system that would need to be repaired first, given that there are
equipment, etc., can be a deterrent. damages to several portions.
Varying the times of patrol and inspection can make observa-
tion more difficult to avoid.
Example 9.4: Low threat of sabotage
The pipeline system for this example has experienced
Less Significant Items episodes of spray painting on facilities in urban areas and
0 Depth of cover-Perhaps a deterrent in some cases, but a few rifle shooting ofpipeline markers in rural areas. The commu-
more inches of cover will probably not dissuade a serious nity in general seems to be accepting of or at least indifferent
perpetrator. to the presence of the pipeline. There are no labor disputes or
0 ROW condition4lear ROW makes spotting of potential workforce reductions occurring in the company. There are no
trouble easier, but also makes the pipeline a target that is eas- visible protests against the company in general or the
ier to find and access. pipeline facilities specifically. The evaluator sees no serious
ongoing threat from sabotage or serious vandalism. The
Special emphasis on these variables may help offset a higher painting and shooting are seen as random acts, not targeted
risk of attack. When evaluating a variable’s contribution to risk attempts to disrupt the pipeline. The evaluator elects not to
mitigation, a condition or activity that plays a more important include a special sabotage threat assessment in this risk
role in the risk picture should have a greater impact on the over- assessment.
all point score.