The oil and gas industry has become increasingly dependent on digital technologies to conduct day-to-day operations including certain exploration, development and production activities. For example, software programs are used to interpret seismic data, manage drilling rigs, production equipment and gathering and transportation systems, conduct reservoir modeling and reserves estimation, and for compliance reporting. The use of mobile communication devices has increased rapidly. Industrial control systems such as SCADA (supervisory control and data acquisition) now control large scale processes that can include multiple sites and long distances, such as power generation and transmission, communications and oil and gas pipelines.
We depend on digital technology, including information systems and related infrastructure as well as cloud applications and services, all of which is managed by EnerVest pursuant to the Services Agreement, to process and record financial and operating data, communicate with our employees, vendors and service providers, analyze seismic and drilling information, estimate quantities of oil and gas reserves as well as other activities related to our business. Our vendors, service providers, purchasers of our production, and financial institutions, are also dependent on digital technology. The technologies needed to conduct oil and gas exploration and development activities and global competition for oil and gas resources make certain information the target of theft or misappropriation.
As dependence on digital technologies has increased, cyber incidents, including deliberate attacks or unintentional events, also have increased. A cyber-attack could include gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data, or causing operational disruption, or result in denial-of-service on websites. SCADA-based systems are potentially vulnerable to targeted cyber-attacks due to their critical role in operations.
Our technologies, systems, networks, and those of our vendors and service providers may become the target of cyber-attacks or information security breaches that could result in the unauthorized release, gathering, monitoring, misuse, loss or destruction of proprietary and other information, or other disruption of our business operations. In addition, certain cyber incidents, such as surveillance, may remain undetected for an extended period.
A cyber incident involving our information systems and related infrastructure, or that of our vendors and service providers, could disrupt our business plans and negatively impact our operations in the following ways, among others:
?unauthorized access to seismic data, reserves information or other sensitive or proprietary information could have a negative impact on our ability to compete for oil and gas resources;?data corruption, communication interruption, or other operational disruption during drilling activities could result in failure to reach the intended target or a drilling incident;?data corruption or operational disruption of production infrastructure could result in loss of production, or accidental discharge;?a cyber-attack on a vendor or service provider could result in supply chain disruptions which could delay or halt a development project, effectively delaying the start of cash flows from the project;?a cyber-attack on a third party gathering or pipeline service provider could prevent us from marketing our production, resulting in a loss of revenues;?a cyber-attack involving commodities exchanges or financial institutions could slow or halt commodities trading, thus preventing us from marketing our production or engaging in hedging activities, resulting in a loss of revenues;?a cyber-attack on a communications network or power grid could cause operational disruption resulting in loss of revenues;?a deliberate corruption of our financial or operational data could result in events of non-compliance which could lead to regulatory fines or penalties; and ?business interruptions could result in expensive remediation efforts, distraction of management, damage to our reputation, or a negative impact on the price of our common stock.
Our implementation of various controls and processes to monitor and mitigate security threats and to increase security for our information, facilities and infrastructure is costly and labor intensive. Moreover, there can be no assurance that such measures will be sufficient to prevent security breaches from occurring. As cyber threats continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities.