Refineries and petrochemical sites
Refineries combine a very large footprint, continuous operation and hazardous-area electrical rules that dictate where equipment may be installed, inside a compliance framework that has been unenforceable since 2023.
Key facts
- The Chemical Facility Anti-Terrorism Standards programme lapsed in July 2023, and CISA has stated it cannot enforce compliance, conduct inspections or require site security plans while the authority remains expired.
- CISA has continued to encourage facilities to maintain their security measures voluntarily, so the absence of enforcement is not an absence of risk.
- Aerial reconnaissance of a refinery supports an attack conducted from outside the perimeter, so the security question concerns what overflight reveals rather than what the aircraft carries.
- Electrical area classification under NEC Article 500 governs what equipment may be installed in hazardous zones, which constrains sensor siting at a refinery more than at any other facility type.
- Detection is lawful for a refinery operator to deploy; mitigation is not available to a private operator under United States law.
What makes this facility type different
The threat model
Aerial reconnaissance of process units, tankage, control rooms and pipeline corridors supports an attack mounted from outside the fence, and the 2019 attacks on Saudi Arabian oil facilities established that unmanned aircraft can be used against energy infrastructure at scale. The consequence model is process safety rather than data loss, because a successful strike on the wrong vessel produces a fire or release rather than an outage.
The regulatory position
The Chemical Facility Anti-Terrorism Standards lapsed on 28 July 2023 when Congress allowed the statutory authority to expire, and CISA has since been unable to enforce the regulations, require reporting of chemicals of interest, conduct inspections or compel site security plans. Refineries therefore sit in a compliance vacuum, retaining the risk while the federal mechanism that once structured the response is dormant.
What constrains the response
Large parts of a refinery are electrically classified hazardous areas under NEC Article 500, where any installed equipment must be rated for the classification of the zone it sits in. Sensor siting is therefore constrained by ignition risk before it is constrained by coverage, and the best position for detecting an aircraft is frequently a position where ordinary equipment may not be installed at all.
The programme that used to structure this is dormant
Refineries are unusual among critical infrastructure in having lost their regulatory scaffolding rather than gained it.
The Chemical Facility Anti-Terrorism Standards expired on 28 July 2023 when Congress allowed the statutory authority to lapse. CISA has since been unable to enforce the regulations, require reporting of chemicals of interest, carry out inspections, or compel facilities to implement site security plans. It continues to encourage operators to maintain their measures voluntarily.
The practical effect is a vacuum. The risk is unchanged, the plans mostly still exist, and the mechanism that used to drive review and inspection is not operating. Security spending in that environment has to be justified internally rather than by pointing at a requirement, which changes how the case has to be made.
It also means a proposal citing CFATS as a reason to buy something is citing a programme that cannot currently require anything.
What overflight is for
The realistic value of a drone over a refinery is knowledge. Process units, tankage, flare systems, control rooms, pipeline corridors, gate positions, patrol timing. That knowledge makes an attack from outside the fence feasible by identifying what to aim at.
The 2019 attacks on Saudi Arabian oil processing facilities settled the question of whether unmanned aircraft can be used against energy infrastructure at consequential scale. What distinguishes a refinery from a substation or a data centre is the consequence model: the outcome of a successful strike is a process safety event, meaning fire, explosion or release, not a loss of service.
Where sensors may go is decided before coverage
This is the constraint that catches people arriving from other sectors, and it has nothing to do with drones.
Large parts of a refinery are electrically classified hazardous areas under NEC Article 500. Equipment installed in those areas must be rated for the classification of the zone. Ignition risk governs, and it governs absolutely.
Sensor siting at a refinery therefore starts with the classified-area map rather than treating the electrical question as a later check. That map is an input from the beginning, and the position offering the best sightline across a process area is frequently a position where ordinary equipment may not be installed. A coverage design produced without the classification drawings is a design that will be revised.
Continuous operation compounds it. Installation competes with turnaround scheduling, and areas cannot generally be taken out of service to a security timetable.
What the work looks like here
Exposure assessment against approach routes and the assets whose loss carries process safety consequence. Coverage design worked against the classified-area map rather than against a site plan. A specification that states the area rating required of any installed equipment. And, because the compliance driver is dormant, a written basis that can carry an internal capital case on its own merits.
Related work
- Site assessment & design Vulnerability assessment, RF survey, sensor siting and coverage modelling.
- Procurement advisory Specification and evaluation against the Authorized Systems List.
- Detection system integration Bringing sensors, command-and-control and existing security systems together.
FAQ
▸Does CFATS still require us to do anything about drones?
CFATS is not currently enforceable. Congress allowed the statutory authority to expire on 28 July 2023, and CISA has said it cannot enforce the regulations, require chemical of interest reporting, inspect, or compel implementation of site security plans. CISA continues to encourage facilities to maintain their measures. Any vendor citing CFATS as a live mandate for a drone purchase is citing a dormant programme, and the current status should be confirmed directly rather than taken from a proposal.
▸Where can detection equipment actually be installed on a refinery?
Outside the classified areas, or inside them only using equipment rated for the applicable classification. This is the constraint that most often surprises people arriving from other sectors, because the positions that give the best sightlines across a process area are frequently the positions where ordinary equipment cannot be installed. Siting should be worked through with the site's electrical classification drawings rather than from a site plan.
▸Is the realistic threat an attack or surveillance?
Both, and they are connected. Surveillance is what makes an attack feasible, because it identifies which vessel, unit or control point matters. Most sites will experience overflight and never an attack, and the value of detection is largely in knowing whether the overflights form a pattern.
▸Can we take action against a drone over the plant?
Not as a private operator. Mitigation is reserved to authorised federal agencies and, since 1 July 2026, to certified state, local, tribal and territorial law enforcement and correctional agencies. A refinery may detect, identify, track and report. Where overflights are persistent, the relationship with the agency holding that authority is the route that actually leads somewhere.