Oil major Statoil missed multiple warning signs and failed to foresee or prepare for incidents like January's deadly attack at an Algerian plant in January, an internal company investigation said, painting a picture of chronic security problems at the site.
Some 40 workers, including five Statoil workers, were killed when Islamist militants raided the In Amenas gas plant deep in the Sahara desert, near the Libyan border, taking foreign workers hostage in a four-day siege that ended when Algerian forces stormed the plant.
Statoil and BP, its partner in the In Amenas venture, have said it was impossible to predict an attack of such unprecedented scale.
The Statoil report, however, shows that security at the plant was inadequately managed and revealed for the first time that the facility was struggling with an internal crisis; workers were on strike from mid-2012 until just days before the assault, and some had threatened expatriate employees.
Statoil's board commissioned the report from a panel of internal officers and external international defense and security experts including a former acting director of the CIA, John E McLaughlin.
“Although unforeseen and unprecedented, an attack on In Amenas should not have been entirely inconceivable,” the 78-page report said in a section titled Failure of Imagination.
“Despite the turmoil in the region, the In Amenas joint venture operated on an unchanged threat level from February 2012 until the attack,” the report said.
The 78-page report concluded: “Security is generally not well understood within Statoil's leadership ranks, and as a result has not been prioritized, resourced or managed properly.”
Statoil Chief Executive Helge Lund acknowledged the report and said he did not plan to resign. Chairman Svein Rennemo said the board had full confidence in Statoil's management.
“Before the investigation started, Lund said he was the man in charge and he was responsible,” said Hilde-Marit Rysst, the head of Norwegian energy union SAFE.
“He needs to consider his position after this report, he should consider stepping down,” she said.
The crisis took place, the report noted, in a deteriorating security context, as neighboring Libya had become “a large ungoverned space”, and Mali had “developed into a safe haven for jihadists and terrorists”.
Algeria's oil industry relies heavily on foreign investment and needs billions of dollars in new investment to revive stalled growth and keep supplying Europe with oil and gas.
BP and Statoil have yet to send their expatriate workers back to the plant. Algeria has not done enough to remove their concerns about security, they say.
“There has not been any high-level strategic security dialog with Algerian authorities involving the companies,” said the report, released on Thursday.
The report showed security at the plant was divided into an internal layer, for which the joint venture was responsible, and an external layer provided by the army.
Complicating the situation, security inside the facility was provided by an external contractor, and then some responsibility was transferred to the security unit of Algeria's state energy firm Sonatrach.
“In effect it meant that there were two parallel security organizations operating at the site, not always with a high degree of mutual respect, trust and collaboration,” the report said.
Against this background, it would hardly be surprising if the attackers had benefited from some inside knowledge, the report concluded.
“The extended strike reduced internal security resilience, eroded loyalty and morale among some of the employees,” it said. “Information from interviewees indicates that the terrorists ... knew which sites to drive to, which offices to target, and they searched for a few people by name.”
Finally, internal security had limited exchange of information with the army and relied too heavily on local authorities for protection, the investigation concluded.
“Neither Statoil nor the joint venture could have prevented the attack, but there is reason to question the extent of their reliance on Algerian military protection,” the report said.
The plant usually employs around 700 people, mostly Algerians, and at the time of the siege BP had about 20 people on site, while Statoil had 17. There were also dozens of foreign subcontractors on the site.
Responding to the report, BP said agreement on further security measures was still needed before people could return.
“There are many questions arising which BP is not in a position to answer, including how the terrorists were able to breach the military zone to attack the plant,” BP said.
BP also said it had no evidence that the workers' strike had any connection to the attack.
“BP was not aware of any specific threat against the plant or British or Western interests in the area prior to the attack,” it said.
Officials in Algiers could not immediately be reached for comment. One industry official close to the talks with the energy firms said a return of expatriate workers was close, but there were outstanding matters to resolve.
Algerian officials have in the past said they have met all security demands made by the companies.
The facility, operated by BP, Statoil and Sonatrach, was producing about nine billion cubic meters of gas per year, some 11.5 percent of Algeria's total, but it continues to run below capacity as it sustained major damage in the attack.