Resilience

Gas Refinery Attack in Algeria: The Lessons Learned

by Joseph Trindal

In the early morning hours of 16 January 2013, a coordinated band of terrorists attacked a convoy of gas refinery workers as they departed the housing area of the In Amenas Gas Refinery in eastern Algeria. The attack was described in a 25 January 2013 article – in Chronicles: A Magazine of American Culture – as the “most elaborate” to date on the African continent. Targeting critical infrastructure, the In Amenas attack is considered to be equivalent to India’s energy-sector incident in November 2008, which included a coordinated attack, hostage-taking, and three-day siege in Mumbai. The Algerian incident led to a four-day siege resulting in the deaths of 38 hostages.

The Situational Environment The In Amenas Gas Project is a multinational joint venture and the largest production wet gas facility in Algeria. The Tiguentourine facility, which is only 50 miles from the Libyan border, processes over nine billion cubic meters of natural gas annually. The desolate In Amenas area of Illizi province is also 717 miles from the population center of Algiers. According to Sonatrach, Algeria’s state-owned petrochemical company, more than 700 workers are assigned to the facility.

Among the workers present on 16 January were over 130 foreign nationals and expatriates from Norway, Japan, England, the United States, and several other countries. The site’s geographic isolation, which delayed response forces, coupled with the presence of large numbers of western workers, favored the terrorists’ objectives.

The region has experienced decades of terrorist activity as part of the Islamic Maghreb effort to establish an Islamic caliphate across northwestern Africa. Struggles with Islamic radicals in Algeria, often referred to as the “gateway between Europe and Africa,” boiled into civil war in the 1990s. In 2006, after a period of deescalating tension, al-Qaida formally joined forces with the Salafist Group for Preaching and Combat, also known as the Groupe Salafiste pour la Prédication et le Combat (GSPC).

In 2007, the solidified group became known as Al-Qaida in the Islamic Maghreb (AQIM). According to Algerian government sources, Algeria, a former French colony, experienced nearly 200 attacks each year in 2011 and 2012, the majority of which targeted military and police as well as western workers and tourists with bombings, ambushes, and kidnappings. Algerian counterterrorism efforts produced encouraging results in 2012, and helped to foster the expansion of foreign investment in energy production. That same year, though, Mali – a small country southwest of Algeria – cascaded into civil war as insurgent forces swept toward the country’s capital of Bamako resulting in French military intervention.

An Attack “Signed in Blood” Late in 2012, plans and preparations were underway for an AQIM attack in Algeria targeting multinational-owned, critical infrastructure with easy access from safe-haven terrorist bases in Libya. According to a 21 January 2013 article in MacLean’s magazine, Algerian sources reported that at least one of the attackers had been a driver at the facility; an indication of insider-sourced pre-attack intelligence used in planning. The “Signed in Blood Battalion” – a self-named sub-group of the AQIM that is commanded by and under the operational command of Mokhtar Belmokhtar – launched the attack with a heavily armed team of 33-40 terrorists.

Two Canadian citizens were members of the attack team, according to Algerian sources. In addition, the terrorists convoyed from Libya, under the cover of darkness, in as many as nine Toyota vehicles disguised with markings resembling those on Sonatrach company vehicles. The terrorists, who were armed with AK-47 rifles, PKM variant machine guns, RPG-7 grenade launchers, and an array of explosives, first ambushed an escorted convoy of buses carrying workers departing along the single access road from the gas plant’s Al-Hayat housing complex, which is about 1.5 miles from the main plant. The terrorists then proceeded to neutralize the plant’s security checkpoint with small arms fire – but not before Mohamed Lamine Lahmar, a security guard later killed in the engagement, had activated the plant’s distress alarm. The terrorists then divided into several assault teams, executing coordinated operations against the Al-Hayat complex and the Tiguentourine processing facility.

At both locations, word spread quickly as workers responded to the piercing alarm, coupled with the information that they were under attack. Thanks to the early warning and to the quick thinking of many workers who adhered to the site protocols governing responses to terrorist attacks, some were able to escape or hide. Other workers in the plant’s process control room began shutting down processing units and gas feed valves; these actions also were consistent with the plant’s protocols for responding to alarms. As the terrorist assault continued, survivors later reported, electricity was being shut down throughout the site.

The survivors also reported that the terrorists started to collect and segregate the hostages into small groups. Unlike the relatively compressed ground areas in other hostage takeovers – the 2002 Beslan school attack in Ingushetia, Russia, for example, and the Dubrovka theater attack in Moscow that same year – the In Amenas Gas Refinery is a sprawling complex covering slightly over five square miles. The plant’s workers, supported by a modest security force, are scattered throughout the entire area.

In addition to the elements of surprise and overwhelming force, the survivors also reported that the terrorists used both ruse and deception – coercing some hostages, for example, to lure hiding workers into the open. Some of the hostages were summarily executed, regardless of their compliance with terrorist instructions. Most of the Algerian workers and Muslims were released, but some non-Muslim foreigners were not only retained but also were fitted with collar and belt bombs.

As the terrorists consolidated their control over the facility, the hostages were dispersed to various holding locations throughout the complex. According to at least some reports, the terrorists also rigged: (a) victim-operated improvised explosive devices (VOIEDs) and/or other booby traps at key access points; and (b) various other explosives at key processing locations (in an apparent effort to ultimately detonate the entire site).

The Response Algerian forces started their response within a couple hours after the attack started, but the remote location of the plant delayed the arrival of any sizable counterterrorist force during most of the first day. The remote location of the plant and complexity of the attack also made a situational size-up and the collection of ground truth intelligence more difficult. During the first night, however, the first Algerian forces arriving started to contain the site.

Very early on the morning of the second day, a group of about 45 survivors escaped on foot from the Al-Hayat complex into the desert. According to Alan Wright, a 37-year-old health and safety advisor at the In Amenas refinery, he and the other survivors were intercepted in the desert by armed personnel, but were not sure if the latter were terrorists or government response personnel. They were relieved to learn that they were government forces, who were themselves not sure of theentities of the people running toward them in the desert. Also early on the second day, Algerian helicopter gunships engaged and neutralized two vehicles travelling along the only access road away from the Al-Hayat complex. It was later reported that the vehicles were carrying both terrorists and hostages. Other workers escaped in various ways during the siege.

As the world’s attention became increasingly focused on the In Amenas hostage crisis, Algerian forces cleared and secured the Al-Hayat complex and security checkpoint, consolidating the government’s containment of the Tiguentourine processing facility. Communications between the hostage takers and government forces were unproductive and the terrorists escalated the situation by threatening to detonate the plant if a rescue operation were attempted. During the siege, AQIM announced two demands: (a) The cessation of French operations in Mali; and (b) the release of two prisoners being held in the United States: Sheikh Omar Abdel-Rahman and Pakistani scientist Aafia Siddiqui.

Finally, on the fourth day of the siege, amid sporadic exchanges of gunfire with the terrorists, Algerian forces reported that, because of information about hostages being executed, government troops had started a rescue assault to regain control of the Tiguentourine facility. Participating in the counter-attack were a coordinated force of ground and air units – some of them in Russian-built T-72 battle tanks and armored personnel carriers – and special forces personnel on foot.

According to Algerian government officials, an unspecified number of the 38 hostages killed were found to have died of a single shot to the head, supporting government and survivor reports of hostage executions. In addition, an explosive was detonated next to one of the processing units, but failed to cause much damage, thanks to the early mitigation measures taken by plant workers on the first day of the siege. Other explosives also were found at various locations throughout the site, indicating that a major sabotage effort was planned but not fully carried out.

Lessons Learned The Refinery attack was in many respects a true watershed event because it demonstrates the will and ability of terrorist groups to plan and execute attacks on very difficult and even remote critical-infrastructure targets. Following, based on the lessons learned from this incident, are some important actions that should be considered to help strengthen risk awareness and also to reassess current response capabilities:

1. Improve Predictive Intelligence Analysis Capabilities – It has been reported that intelligence analysis of the regional, national, and site-specific threat dynamics of eastern Algeria led experts to warn of possible attacks on the multinational oil and gas assets in the region on at least two occasions in 2012. Despite those clear warnings, the composition of the plant’s security force was not changed. The security forces at high-risk and high-value sites should be prepared to act quickly and effectively on the changing threat dynamics developed by predictive intelligence. Preparations should include objective analytics directly linked to the actionable procedures needed to improve measurable security enhancements. For example, accepting the In Amenas incident as a form of predictive intelligence, other sites should now:

Reassess their relevant vulnerabilities and incorporate assault team attack response and mitigation measures in the site’s emergency plans and exercise regimen;

Enhance employee awareness of assault situational dynamics together with the reporting and response action protocols according to individual position and collateral position responsibilities; and

Correlate situational awareness value and response expectations to other likely incident scenarios – for example, discovering an armed intruder on the site.

2. Reassess “Hardened” and “Remote” Target Analyses – The remote geographic location of a critical infrastructure asset is often considered an attack deterrence. In the In Amenas incident, though, the remote location, combined with what seems to have been a lower local response capacity, may well have been viewed by the terrorists as an important operational advantage. Considering the planning, command, and control coordination necessary to seize such a large complex – and to wrest control from over 700 workers – the remote location gave the terrorists the critical time needed to subdue and dominate the site with little if any interference from external response forces. Positioning high-value and high-risk sites in remote locations may in fact result in greater vulnerabilities and greater reliance on internal and self-sustained capabilities.

3. Prepare and Practice for Extreme Scenarios – Although the probability of multiple terrorist assault teams descending on a site seems to be remote, the adverse consequences to the site, its corporate assets, and the local community, coupled with broader cascading impacts, could be widespread. Therefore, developing, training, and exercising response procedures for such remote risks are prudent in preparing for more routine disruptive events. In that context, functional and capabilities-based preparations should include multidimensional threat scenarios including the relevant cascading complexities. Advance planning and the development of mandatory capabilities also should include the positioning of response elements beyond the site’s property line – thereby integrating local and regional response assets of diverse emergency response disciplines into preparedness plans and activities. Vital response partners include off-site corporate assets and even multicorporate stakeholders having vested interests in the site.

The In Amenas Gas Refinery did have a number of procedures in place to cope with a terrorist assault – including the actions assigned to workers in housing areas, other support sites, and the processing control rooms. The site procedures included alarm announcements and follow-on duty and responsibility assignments. Official reports show that the efforts of one security guard, Mohamed Lamine Lahmar, saved numerous lives by the prompt and effective actions he took in the opening moments of the attack – actions that cost him his own life. Only through practice and scenario-based exercises can site personnel perform in predictable ways when faced with real-world contingencies.

4. Prepare Responders for Special Site Hazards – Counterterrorism and police response preparedness to sites containing particular internal hazards require specialized awareness, analysis, and skills unique to responder disciplines and properly aligned with their own individual and team capabilities. Unfortunately, the Algerian response forces at the In Amenas Gas Refinery lacked the preparatory experience needed to cope with the hazards posed by engaging in live-fire interdiction in the areas around pressurized flammable gas processing units at the site. It is still not known, in the open-source reports currently available, what p