The industry held hostage by terror

It was a facility so strategically significant that ISIS fought close to a year-long battle to keep it. The Baiji Oil Refinery, situated 200km north of Baghdad, is one of the most important pieces of energy infrastructure in Iraq, producing close to a third of the country's domestic fuel. It fell under the control of ISIS last June, as part of their broader push towards the capital.

Their hold was weak, however, and the facility was lost and recaptured numerous times until May, when a government counter-offensive led ISIS forces to withdraw conclusively. But despite having been described by Public Radio International's (PRI) The World as "too important to destroy", they did just that, setting off explosives and destroying equipment in the refinery. The black smoke could be seen from Baghdad, and the refinery is now, according to Ben van Heuvelen of Iraq Oil Report, speaking to PRI, "probably unusable for several years, if ever again".

Acting on the side of caution

Across the region, this is what oil companies - and the governments that host them - fear the most: full-scale terrorist attacks on key assets, the destruction of billions of dollars of equipment, and the risks these factors places on employees. With the rise of the so-called Islamic State and broader insecurity and instability - from Syria to Libya, from Iraq to Tunisia - the region, which holds up to 66% of the world's known oil reserves, is an increasingly dangerous place to do business on a day-to-day basis.

Governments know this, and major oil-producing states are taking whatever precautions they can. At the beginning of their armed intervention against an Iran-backed insurgency in Yemen in March, Saudi Arabia and Kuwait announced they were significantly strengthening security, enhancing safety measures around key oil facilities.

"In the light of developments in Yemen, to protect the strategic interests of the oil sector and to secure oil products for inside and outside, several procedures and precautionary steps have been taken," said chief executive officer for the Kuwait Petroleum Corp Mohammed al-Farhoud.

Months later, in the aftermath of a devastating attack on a Shi'a mosque that claimed 27 lives, the Kuwaiti authorities raised security levels for petroleum facilities, bringing in armed protection.

"Kuwait Petroleum Corp and its subsidiaries have raised security measures to the maximum level, following the terrorist bombing on Friday," said Sheikh Talal Khaled Al-Sabah at the time, spokesman for the state-owned company. "All refineries, oilfields and oil sector operations have been placed under heightened security measures to maintain normal operations without being affected by the terrorist threat."

Privatised protection

And things are not looking to change any time soon. Ian Lesser, senior director for foreign and security policy at the German Marshall Fund think tank, argues that part of doing business in this region in the coming years will require adjusting and taking stock of the risks that foreigners in the Middle East now unavoidably face.

"The most fundamental point is that this is not a transient problem," he says. "The very chaotic conditions that have allowed ISIS to thrive and, in some cases, the chaos that ISIS has managed to spur in the region, is not going to go away anytime soon.

"This is, in a way, the new normal. Companies and institutions with long-term stakes are going to have to adjust to this reality."

Lesser argues that while states have long been partners in providing protection for energy infrastructure and energy operations, many in the region are increasingly hard pressed with their own complex security challenges.

"This can complicate cooperation with central governments, because they're going to be stretched in terms of resources," says Lesser. "They may have other priorities, and they may, in fact, have lost the ability to control certain areas of their territory."

Cooperation between public and private actors is simultaneously more important but less possible in this new environment, making commercial operators reliant on expensive private security options in areas where they might previously have trusted states. In circumstances where governments simply cannot expend the resources needed to keep oil companies safe, the private sector has taken over almost entirely.

"Governments may not be as capable security partners as they were in the past," he argues. "That is, in the big sense, one of the things you see happening right across the region. In key places, it's simply the declining capacity of governments to govern."

Risky business

Part of the "new reality", as Lesser puts it, comes down to a change in priorities for terrorist groups. Where once jihadist organisations saw oil assets - from pipelines to refineries - as targets for sabotage or bombing attacks, they now see it as more advantageous to control and exploit them.

"It seems, as much as we can judge, that ISIS and related groups have tended to see energy infrastructure as more of a prize than a target," he explains. "We'll have to see where ISIS goes in terms of actually targeting infrastructure; again, I don't see much evidence that it's in their interest to do this."

Lesser points to the fact that, far from destroying oil production infrastructure to undermine enemies, ISIS has usually used it as a tool for its own enrichment. Profits from smuggled barrels play a key role in how the organisation finances itself, earning millions of dollars a week from oil production within its controlled territory.

This means that security priorities have also shifted, from protecting pipelines and preventing sabotage, to providing security for personnel operating rigs. This comes in the form of armed security and a heightened awareness of political risk, priorities that come from a balance of government and the private sector.

This is not to say that, as seen in Baiji, the actors are always predictable. And there's an increasing sense that, even in countries previously lauded for their ability to guarantee stability and protect foreigners, workers in the oil industry are seen as potential targets for terrorism.

In March, the State Department's Overseas Security Advisory Council (OSAC) warned that jihadist organisations were planning kidnappings and attacks against employees of Chevron in Saudi Arabia's Eastern Province, advising workers to take precautions and prompting the authorities to ramp up security measures - including imposing curfews and checkpoints, and improving bomb detection.

"These actors could well create conditions that make it difficult to operate in a predictable manner,as is the case in Libya today," says Lesser. "I wouldn't limit this to ISIS, but I would talk more broadly about Islamic militants across the region, who may wish to target foreign assets, foreign employees and the energy sector of key countries, with an aim of destabilising the governments concerned."

Fight or flight

This is not to say there aren't measures that can be taken to minimise risks, even in extremely difficult areas. Oil companies can invest in hiring armed security to travel with workers from living quarters to where they work (routes where workers might be particularly vulnerable), training employees in surviving kidnapping and terrorist attack scenarios, taking evacuation precautions, and teaching emergency first aid and basic self-defence.

But in many cases, it seems, the new instability in the Middle East will simply lead to a reorientation of risk priorities. Instead of expending large sums on private security for personnel in regions where the state is not capable of guaranteeing protection, oil companies might choose not to take the risk in the first place.

"There are certain kinds of risks that are not sustainable and, as always, companies will have to make judgements about when those risks are no longer viable," says Lesser.

"At the end of the day, there are certain basic physical and business drivers of these questions: where the resources are, where it's economic to exploit them, where the buyers are, and so on, or where the infrastructure makes it practical... there are a lot of things that go into this equation."

When ISIS took over large swathes of Iraq last year, for instance, instead of opting for heightened security measures, BP and ExxonMobil withdrew large numbers of their staff from the country for the foreseeable future.

Current dangers, combined with the high costs of paying private security to protect personnel, might increasingly lead companies to look elsewhere for investments, and to oil-producing countries where there are fewer risks and lower security costs, according to Lesser.

"It may cause companies to look at their portfolios in a much more global way," he argues. "The Middle East and North Africa will be chaotic, maybe increasingly so for a decade or more. This has long-term implications for investment, and for where companies go to look for new and sustained business."

One of these markets could be, surprisingly, Iran. With the news of the nuclear deal between the US and the government of President Rouhani last month, it appears that the country's 36-year economic isolation is finally coming to an end. This means, at least in theory, that the country's oil reserves - some of the largest in the world - are open to international companies.

"It may turn out that companies now have greater access to the Iranian economy," says Lesser. "And if there are going to be new investments in the Iranian energy sector, this, in an increasingly chaotic region, will look like a relatively stable bet.

"We've replaced some more or less conventional geopolitical risks with some highly unconventional - but probably quite durable - risks associated with chaos."

With oil prices not looking to rise significantly any time soon, and the tragic chaos in the Middle East set to continue for the foreseeable future, it's increasingly obvious that oil companies are in a position where they must choose between the high costs of keeping employees safe in a difficult region, or looking further afield for their needs. Those that stay in risky areas might reap the rewards, but it will cost them.