Aramco’s journey began with the signing of an oil concession agreement with the Standard Oil Company of California on May 29, 1933 which paved way for the beginning of aerial surveys the following year. In 1935, the first oil well was drilled and a new pier was erected at al-Khobar at a time when more proven oil finds were located in Bahrain, Iraq and Persia. In 1936, the Texas Co. made a 50% acquisition of the concession and launched operations in Bahrain. By 1939, various wells had been drilled and for the first time, an oil tanker transported the first load of petroleum from Saudi Arabia. Aramco was officially on its way to becoming the corporation it is today (Saudi Aramco 2012).
Photo 1: Aramco’s first oil shipment out of Saudi Arabia in 1939 using a fuel tanker [Source: ARAMCO]
By the beginning of the 1940s, the company was producing about 15,000 bpd and its workforce had grown to nearly 4,000. 1940 began with the discovery of the Abqaiq oil field but during the early years of the 1940s, the company faced some difficulties including the closure of its refinery at Ras Tanura in 1941 and suspension of field mapping in 1942. 1943 witnessed growth of innovation in the oil and gas industry due to the shortages occasioned by the World War II and Casoc was renamed Aramco in 1944 with headquarters in San Francisco and an amazing journey of remarkable growth began. As of 1949, Aramco had increased its productivity to 500,000 bpd. In 1946, the company commissioned its administration building in Dhahran and the decade ended with the completion of the Trans-Arabian Pipeline enabling Saudi Arabia to export its oil through the Mediterranean Sea (Saudi Aramco 2012).
In 1951, the Safaniya offshore oil field was discovered and the following year, Aramco moved its headquarters to Dhahran. In 1954, the company’s production reached 1 million bpd transforming Aramco into an oil production powerhouse (Saudi Aramco 2012). Exploration work at Rub’ al-Khali began in 1955 and by 1958; the company’s production had topped 1 million bpd. The close of the 1950’s saw two Saudi nationals joining Aramco board as more Saudis assumed managerial positions within the company. In 1961, the company hit yet another milestone when it exported liquefied gas from its Ras Tanura facility for the first time. By 1962, production of crude oil had hit the 5 billion barrels mark and the following year, the company patented its oil sweetening technology. In 1965, Aramco’s oil production reached 2 million bpd and the discovery of the Shaybah oil field further boosted the company’s productivity. The company closed the decade with the commissioning of an offshore gas-oil separation plant at the Safaniya oil field, the first of its kind in the history of Aramco (Saudi Aramco 2012).
Photo 2: Aramco’s first offshore gas-oil separation plant at the Safaniya oil field commisioned in 1969 [Source: Aramco]
During the 1970s, the Saudi Government began the acquisition process aimed at changing Aramco into a fully government owned company or a national oil corporation (NOC). It is a decade that would witness rapid growth in the oil and gas industry as Aramco was operating three of the largest oil and gas projects in the world (Saudi Aramco 2012). The company had officially taken the lead in oil and gas production and taken its rightful place in the global energy security landscape. In 1973, the Government acquired a 25% stake in Aramco followed by a further acquisition of 35% in 1974 bringing the Government’s ownership of the Aramco to 60%. The same year, the Ju’aymah offshore crude oil terminal was commisioned and in 1976, Aramco became the first oil company in the world to reach an output of 3 billion barrels in one year, a fete that had not been achived by any other company (Saudi Aramco 2012).
In 1980, the Saudi Government completed acquisition of the remaining 40% ownership of Aramco but the decline in oil prices would force the company to rethinkk its strategy (Saudi Aramco 2012). By this time, the governemt owned 100% stake at Aramco and despite the hardships in the global oil market, Aramco made significant strides. For example, the Exploration and Petroleum Engineering Center (EXPEC) was opened in 1983. Having fully acquired the company, the Saudi Government transformed Aramco into Saudi Arabian Oil Company (Saudi Aramco) and in 1989, the company found oil at Hawtah marking the beginning of a decade that would witness massive invention and investment in the oil and gas industry (Saudi Aramco 2012).
Picture 3: Aramco’s Operations Coordination Center, the largest of its kind in the Oil and Gas industry [Source: Aramco]
Aramco began its expansion strategy in earnest with the 1991 acquisition of a 35% stake in S-oil refinery and harbor, Onsan, Republic of Korea (Saudi Aramco 2012). The following year, the company’s exploration efforts yielded discovery of oil in the central part of the country having drilled its first well at Midyan. In 1993, Aramco’s merger with Samarec was completed and the following year, Aramco acquired a 40% stake in Petron, a company based in the Philippines and in 1996, Aramco entered its first European joint venture. In 1999, the company completed the refurbishment of the Ras Tanura refinery before opening a Research & Development Center (R&DC) to spearhead innovation in the oil and gas sector (Saudi Aramco 2012).
Picture 4: Refurbished and upgraded Ras Tanura refinery [Source: Aramco]
During the 2000s, Aramco established partnerships with various international companies with focus on gas production as well as patenting of technology developed by the company’s R&DC. On top of this, Aramco embarked on the largest capital expansion in the company’s history aimed at ensuring stability and reliability. To this end, the company commissioned Hawiyah gas plant in 2001 and in the following year, Aramco acquired Texaco’s stake in Motiva (Saudi Aramco 2012). This was followed by the opening of the Haradh gas plant in 2003 before further expansion plans in 2004 led to rge acquiition of stake in Showa Shell which enabled the company to raise its output by a further 800 thousand bpd. In 2005, Aramco entered into a joint venture with Sumitomo Chemical Company. 2007 saw Aramco enter into yet another equity venture, this time in China with the Fujian Refining and Petrochemical Co. Ltd. In 2008, Aramco celebrated its 75th year in the oil and gas industry and the following year, the company completed its expansion program raising its capacity to 12 million bpd (Saudi Aramco 2012) but with actual production averaging 9.1 million bpd in 2011.
Table 1: Top 10 oil producing companies in the world in 2010 [Source: Aramco]
3.0 Analysis of the al-Shamoon Virus Attack
It is upon this background that the al-Shamoon virus attack should be analyzed to asses the managerial finance repercussions of shutting down a company that going by 2011 figures produced 9.1 million bpd and refined 4.02 million bpd in its facilities around the world. Clearly, Aramco plays a very crucial role in not only stabilizing global oil prices but also safeguarding global energy security which is why a virus attack on the company is more than just a security issue. Indeed, cyber assault has become one of the key managerial concerns in the energy sector (King, 2012) where major corporations have fallen target to hackers with various energy sector companies including Qatar’s Rasgas and ExxonMobil’s joint venture as well as Maersk being targeted in the past few months. As of 2012, the global demand for oil stood at 86 million bpd and with Aramco’s average production for the first three quarters of the year standing at 9.7 million bpd, half a million more than last year, Aramco accounts for about 11.3% of global energy needs (Leyden, 2012).
The choice of August 15 was a calculated move because the hackers new that the company’s employees would not be at work and therefore unleashing the virus on such a day would inflict the most damage. According to Aramco’s press release following the attack, more than 75% of its corporate PCs were affected by the virus. The virus wiped out data ranging from e-mails to spreadsheets, to documents and other types of files from around 30,000 computers. The president and CEO of the company later asserted that the hackers primary intention was to shut down the entire company’s operations including oil and gas production but that this objective had failed and production activities were continuing normally (Perlroth, 2012). As a measure to curb the spread of the virus, the company shut down its entire internal corporate network, and brought in security experts to try and contain its spread as well as analyze its code in order to ensure that the company took the necessary measures to prevent the occurrence of a similar attack in future.
One of the effects of this attack is that employees can no longer remotely access the internal network as well as their corporate network email as they used to due to constant disruptions and fear that allowing remote access makes the company more vulnerable to similar attacks (Perlroth, 2012). The managerial finance repercussion of this is that the cost of operation rises since teleworking is not as efficient as it was prior to the attack and this means that employees productivity reduces directly impacting on Aramco’s bottom-line. Ultimately, the organization losses a lot of man hours as a result of this attack. In addition, Aramco had to substantial results not only through contracting international security experts in the wake of the attack but also in replacing the affected computers to fully purge the internal corporate network off the al-Shamoon virus. While a company of Aramco’s stature would most likely downplay the effects of an external threat of this magnitude as the company evidently did, the effects are more widespread than the company would admit (Leyden, 2012).
Given the role of Aramco in ensuring price stability in the global oil market, the primary role of the company in this regard is to reassure the market that all is well and that there is nothing to worry about in as far as oil productivity and availability in the market is concerned (Leyden, 2012). Any hint that a company that produces more than 11% of the world’s petroleum needs could be incapacitated would send shockwaves throughout the global oil market and inevitably result in an escalation of oil prices. That seems to be the underlying market concern and the reason why after the al-Shamoon virus attack, the company would continue to spend colossal amounts of money in safeguarding its installations - an issue that is ultimately managerial more than it is security. In an interesting PR stunt, Aramco’s management limited the damage caused to the system to the cost of replacing the hard disks of the 30,000 PCs affected by the virus and the time it took the IT department to complete the work of replacing the disks (Perlroth, 2012).
According to Ashford (2012) however, the destruction caused by the virus is more than Aramco is willing to admit. For starters, even though the company admitted that 30,000 computers were damaged and that the data in those computers could not be recovered, this lost data has not been quantified and the company only limited the cost to replacing the hard disks. Clearly, what is of value is not the hard disks themselves but rather what they contain and until that lost data is quantified and a cost attached to it, the actual cost arising from the attack will remain a mystery. In addition to this, the attack affects more companies than just Aramco in terms of increased security spending to avert similar attacks (Kennedy, 2012). The scale of the company and the success with which the virus destroyed data has caused other companies in the industry to rethink their own security. Interestingly, in an effort to further downplay the attack, Aramco’s management asserted that indeed the August 15, 2012 attack was not the first time the company’s computer system was being attacked and further stated that “it would not be the last time either”.
Notably, it took Aramco more than a week - precisely 10 days to replace the hard disks on the computers that were affected by the virus and put the internal system back up, a factor that from a management perspective raises further questions about the actual cost of the sabotage (Ashford, 2012). Considering that 30,000 workstations were affected during the attack, then from a conservative estimate, it would mean the affected employees lost a minimum of a week in lost man hours and therefore the time lost by the company employees is not just what was spent on the restoration exercise by the IT department as Aramco would like people to believe. The losses arising from this incidence clearly goes further than the IT department. Assuming that the company’s oil production activities were not affected in any way and that, in the company’s vice president’s words “not a single drop of oil was lost”, the issue of reduced productivity in as far as human resources are concerned still arises meaning that there were still more losses than the company admits (Mahdi, 2012).
4.0 Summary of observations
Through analyzing this incident, a number of issues have been observed and these are summarized below;
- The attack on Aramco with the al-Shamoon virus was quite sophisticated due to the amount of damage that it was able to inflict and therefore this attack is a security issue as well as a financial management issue due to the costs of dealing with the aftermath of the attack
- As a global energy player, the environment that Aramco operates in is faced with high threats and if an organization of its pedigree can be attacked with such devastating results, the industry as a whole needs to rethink its financial management and security environment
- Cyber attacks targeted at corporate entities and purely orchestrated for the purpose of destroying company data as well as the computer systems appears to have come of age and the threat of such attacks in the future as Aramco’s CEO put it are real
- As an organization, Aramco’s control measures appear to be robust enough because despite the widespread damage, only workstation computers were affected and the server as well as administrative accounts were left intact hence the company’s production activities were not disrupted
- The incidence response plan executed after the attacks was more of a managerial decision making process where the company’s top management was actively involved in neutralizing the threat as well as information dissemination
5.0 Conclusion
Examining the impact of the August 15, 2012 virus attack on Aramco indicates that a virus attack of that magnitude extends beyond just the security department of an organization and effective control of such sabotage is more of a managerial decision making process. The result of sabotaging a company that plays such an important role in energy security has grave economic effects that extend beyond Saudi Arabia as an economy and is therefore not just a security issue as many news media have attempted too portray it. While reassurance from the company regarding oil production is important for the stability of the global oil markets, downplaying the real cost of such an attack only fuels more speculation regarding the actual state of the company’s production facilities. There is no doubt that the real damage caused by this attack is more than the company was willing to publicize and indeed analysts may have to settle for the “most destructive cyber attack of its kind on a corporate entity” tag without actual figures to back it up. The shenanigans surrounding this incidence may be attributed to the political angle relating to the attacks that has dominated the media since the most plausible explanation was that the attack was orchestrated for political reasons (Roberts, 2012).
One of the key implications of this attack is that employees are no longer able to remotely access the internal network as well as their corporate network email the same way they used to prior to the attack due to constant disruptions and fear that allowing remote access makes the company more vulnerable to similar attacks. Consequently, this issue goes further than merely security because if employees are not able t work the same way they used to before, then their productivity is likely to be lower than it was prior to the attack and this is a yet to be quantified effect . In addition, many analysts are of the view that since the attack was orchestrated on a day when employees were not at work, then there is a very high likelihood that there is a huge trove of data that may not have been backed up and was lost completely. The company has not quantified the data that was wiped out and therefore the loss in terms of cost is not public. However, the company’s insistence that loss arising from the attack is limited to replacing of hard disks and the time taken to do so is not entirely correct (Leyden, 2012).
References
Arthur, C. (2012). “Saudi Aramco hit by computer virus”, The Guardian, Article
published in August 16, 2012.
Ashford, w. (2012). “Saudi Aramco oil firm claims to be over cyber attack”, Computer
Weekly, Article published on August 28, 2012.
Fisher, D. (2012) “Some Signs Point to Shamoon as Malware in Aramco Attack” The
Kaspersky Lab Security Networks, Article published on August 22, 2012.
Kennedy, C. (2012). “Shamoon Virus that Attacked Saudi Aramco is the Most
Dangerous to Date”, Oil Price, Article published October 14, 2012.
King, L. (2012). “The Devastating Effects of a Cyber-Attack Against a Country's Energy
Grid”, Oil Price, Article published on July 10, 2012.
Leyden, J. (2012). “Hack on Saudi Aramco hit 30,000 workstations, oil firm admits”, The
A Register, Article Published on August 29, 2012.
Mahdi, W. (2012). “Saudi Arabia Says Aramco Cyberattack Came From Foreign
States”, First Enercast Financial, Article published on December 10, 2012.
Perlroth, N. (2012). “Connecting the Dots After Cyberattack on Saudi Aramco”, The
New York Times, Article published on August 27, 4012.
Roberts, J. (2012). “Cyber threats to energy security, as experienced by Saudi Arabia”,
The Barrel, Article published on November 27, 2012.
Saudi Aramco (2012). “Our History”. Available online at:
, Accessed: December 15, 2012.
by
jadeesh (student)
