Terrorism has become the four-letter word of the insurance industry today. In the past, most companies working overseas didn't lend much credence to threats of terrorism. Risk managers weighed the low probability of an attack against the insurance settlement if such an attack occurred. Barring the human cost, the property would be replaced. The worst aspect was the loss of production. Today, this is no longer the case. Insurance companies are charging far more for insurance on high-threat targets. A terrorist incident against a company's facility now could mean an astronomical rise in the insurance rate. Much more than in the past, companies are going to have to be more involved in the reduction of risk for their assets.

Although land-based facilities are at risk, the more likely targets are on the supply side of oil production. The structures with the highest potential for attack that would produce the most damage are the offshore drilling rig, and the offshore production or processing platform or floating production, storage and offloading vessels (FPSOs).

The first place to start securing an offshore facility is often thousands of miles from the facility itself. Web sites are the first line of defense for the platform. Often, companies have in-depth pictures and descriptions of platforms on their Web sites. Sometimes they even list the latitude and longitude of a facility or at least the area the facility is in. All of these things are designed to assist in marketing the company. It is understandable to want to market the success of the company. However, it is also possible to market these successes with less descriptive information. Terrorists frequently use Web sites, magazines and other forms of media to gather initial targeting information.

The next layer of security asks the human resources department to conduct background checks of individuals who may have key information or access to the offshore rig or other critical facility. This doesn't necessarily mean just the senior leadership. Access also includes individuals who know the scheduling of workboat arrivals and departures, individuals working near any access points, and anyone with knowledge of the structure itself and any of its vulnerabilities.

In terms of security closer to the offshore facility, the focus has to start from a large outer perimeter and work in toward the installation itself. The first issue should be boats in the area and particularly the workboats and helicopters coming to the operation.

Al Qaeda and other terrorist groups have succeeded in the use of aircraft, boats and automobiles laden with explosives to conduct attacks. Incoming helicopters and workboats should make radio contact with the platform approximately 30 miles (48 km) from the facility.

There should be a method of verifying the crew. This entails a code word being passed from the rig or other facility to the aircraft or ship with a coordinated reply word from the aircraft or crew. This is a simple, inexpensive method to ensure the vessel is occupied with an approved crew and has not been hijacked to be driven into the structure. This also prevents terrorists from using the name or number of approved aircraft and vessels to bring one of their explosive-laden vessels to the structure. Equally important should be the development of a stress word. This is a word that can be interjected into a radio call that would inform the security personnel on the rig that the vessel has been hijacked and the crew is being forced to make radio contact. The word or phrase should be such that it appears as normal radio conversation.

For example, if a vessel normally reports in to the platform "Platform, this is supply ship 1," simply adding a letter to the end of the call sign can be used to indicate hijacking, pirating, or other hostile situations. A stress call would sound like "Platform, this is Supply ship 1 A." Another method is to use a phrase. For example, "Platform, this is supply ship 1; we are prepared to dock upon arrival" or something that appears to coincide with normal radio traffic and procedures.

The reason to require radio contacts 30 miles or more from the installation is to allow host nation security forces some time to interdict the vessel prior to it reaching the operation.

Helicopters and ships should report sightings of other watercraft or aircraft in the range from 30 to 50 miles from the operation.

For example, if a helicopter reported a yacht or other small vessel 50 miles from the facility heading toward it, then a separate helicopter observes the same vessel 5 hours later, 20 miles (32 km) out still heading toward the rig, it could be cause for concern. Verification with authorities can determine if the vessel is moving along a preplanned route, to whom the vessel belongs and the country of origin. If this vessel was reported stolen, then authorities should be notified immediately to interdict.

To protect the offshore operation within a 1-mile (1.6-km) radius of the platform, cameras and lighting can be a deterrent. Lighting is usually used at the top of the facility and some lights point toward the water from above. However, the threat of smaller boats being launched from yachts and other small vessels can be diminished with lights pointing out from the platform close to the water line. Lights close to the water line will better light any small boats moving around the facility itself. Depending on the amount of money a company wishes to spend, day/night infrared cameras are also good security improvements. For less money, companies can coordinate inexpensive daylight cameras with the water-line lighting.

Once intruders have been detected and are determined to be hostile, there must obviously be a reaction policy in place to thwart an impending attack. The first line of defense is the host nation security force. If the host nation force can't get into position to interdict a hostile vessel, there must be policies in place for the platform to protect itself. These policies must comply with the host nation laws and international maritime laws.

One of the simple ways to attempt to deter an incoming vessel with hostile intent is with searchlights. Once cameras detect a vessel moving directly toward the platform, using powerful searchlights against the vessel can cause it to veer off course by blinding the driver.

Lastly, employees of oil corporations in general will have to be informed as to the importance of safeguarding information. This is a new world with new threats, and corporate assets and employees are the new targets in the terrorism war. Corporate information protection should become a high-priority matter. Some items of information that should be protected are workboat schedules and flight schedules, specifically, information about the name of the vessel and the time and place of departure and arrival on trips to the offshore operation. Flight schedules and tail numbers, the number of security personnel on the facility, location and number of security cameras, how employee badges are distributed and what codes, if any, identify what access a person has to certain areas should be confidential.

Employees can't just be told, "Don't say these things." They must receive training and a plausible reason as to why it is important to safeguard information. Anytime someone truly believes in an issue, they support it with vigor. With strong emphasis, the corporate information protection policies become corporate culture instead of merely another rule to follow.

Most of the recommendations in this article cost very little money to implement. The reality is, procedural changes will generally thwart more terrorist acts than expensive security equipment alone. In some instances, procedural changes alone can be enough. The right consultant should be able to provide companies with graduated options from procedural changes to major equipment purchases to develop a security plan that fits the need and the budget of the corporation.