The oil system is on the edge. There is little spare capacity, and all of it is owned by Saudi Arabia (of course, if Hubbert's peak is true, even this spare capacity will go away). From the Economist print edition:
Amy Jaffe of the Baker Institute, at America's Rice University in Texas, observes that in 1985 OPEC maintained about 15m bpd of spare capacity about one-quarter of world demand at that time. In 1990, when Iraq invaded Kuwait, OPEC still had about 5.5m bpd of spare capacity (about 8% of world demand). That, argues Ms Jaffe, meant that the cartel could easily and quickly expand output to absorb several disruptions at once. That is simply no longer true. Today's fast-shrinking spare capacity of about 2m bpd is less than 3% of demand and it is entirely in Saudi hands.
So how safe is the Saudi oil system? Here's the picture: the system depicted is a "fortress" style defense: 30,000 guards, surveillance sensors, aircraft patrols, and anti-aircraft hard point defense (from the Economist print edition). Here are some estimates by "security" experts:
Kevin Rosser of Control Risks Group. He observes that there is plenty of redundancy built into the Saudi network through multiple ports, pipelines and excess capacity that should ease the blow from any attack. Besides, he insists, to do any real damage terrorists would have to hit bottlenecks, not just blow up random bits of pipeline.
James Woolsey, a former head of America's Central Intelligence Agency. Guards and fences are easy to put up, but they don't defend against the real threats. Trucks have to come in and out of facilities, he observes, and Aramco employees and security guards have to move about. He thinks that several attacks, if co-ordinated by terrorists who have infiltrated Aramco, could cripple the Saudi system. Mr Woolsey adds that an attack using weapons of mass destruction (especially dirty bombs) would be even more devastating than one that used mere aeroplanes. All told, the pessimists reckon that well-co-ordinated attacks could take as much as 6m-7m bpd of Saudi output off the market for weeks, and perhaps longer.
Robert Baer, an intelligence expert (author of Sleeping with the Devil). He reckons that Ras Tanura, a port on the Gulf, is a vulnerable terrorist target. With an output of perhaps 4.5m bpd, this is the biggest oil-exporting port in the world. Mr Baer thinks a small submarine or a boat laden with explosives (as happened in October 2000 with the attack on the USS Cole off the coast of Yemen) could knock out much of Ras Tanura's output for weeks, or even longer. An even scarier possibility raised by Mr Baer is the crashing of a hijacked aeroplane into Abqaiq, the world's largest oil-processing complex. If done with the help of insiders, he speculates that the facility's throughput (nearly 7m bpd, on his estimate) would be choked off to as little as 1m bpd for two months and might remain as low as 3m bpd for seven months.
NOTE: Fortress defenses are virtually useless. Additionally, redundancy can be defeated through good network analysis. My view is that the real vulnerability is in attacks on ancillary systems with a focus on internetwork cascades of failure.