THE SHELL NIGERIA FILES

Shell’s Blind Pipelines: Internal Review Said Typical Third-Party Spills Could Escape Real-Time Detection

Shell says theft and sabotage caused most Niger Delta pollution. Its own technical records raise a different question: if a thief breached a pipeline, how quickly could Shell actually know that oil was escaping?

A pipeline operator can blame a thief for drilling the hole.

It cannot blame the thief for the quality of its own leak-detection system.

That distinction emerges starkly from two internal Shell documents now public through the HEDA Resource Centre archive.

In November 2012, technical specialists visiting Shell Petroleum Development Company of Nigeria — SPDC — recorded a straightforward concern:

“SPDC needs better leak detection on pipelines and flow lines.”

The following year, an internal review was considerably more specific. It said SPDC’s pipeline infrastructure had “no real-time monitoring capabilities” beyond pressure measurements at stations. The system was capable of reacting to major pipeline ruptures, the review said, but “average 3rd party spills will not be observed” in those station pressure profiles.

Those sentences deserve to be read alongside one of Shell’s central arguments about Nigeria.

Shell says large-scale theft, sabotage and illegal refining caused the vast majority of pollution relevant to the continuing Bille and Ogale litigation. It says criminal gangs repeatedly drilled into pipelines and that its former Nigerian subsidiary spent heavily on pipeline monitoring, surveillance, repairs, shut-ins and spill response. (Shell)

Suppose Shell is correct about the origin of many of those spills.

That does not make leak detection less important.

It makes it more important.

If illegal tapping is frequent, foreseeable and known to management, the ability to discover a breach rapidly becomes one of the principal means by which an operator can limit the environmental consequences.

Yet Shell’s own internal technical record indicates that the real-time system then in place could fail to reveal precisely the kind of smaller third-party spill the company says was endemic.

That is a separate accountability issue from who drilled the hole.

The first warning came from Shell’s own technical specialists

The first underlying record is Document 13 — MPR-10 HB 805-827_260421_132229.

HEDA lists the document in its public cache of Shell records released from the UK proceedings. The 2026 Nigeria: Lifting the Lid report identifies it as Pipeline Integrity Support Visit: SPDC Port Harcourt, 19-23 November 2012, attributed to Shell’s Project and Technology organisation. (HEDA Resource Centre)

This is the same technical visit that identified deficiencies elsewhere in SPDC’s integrity-management arrangements.

But its leak-detection finding deserves separate treatment.

The specialists did not merely suggest that newer technology might someday be desirable.

They identified leak detection as an area requiring improvement.

That was November 2012.

The significance becomes much clearer when placed beside the second document.

The 2013 review explained what the system could — and could not — see

The second principal record is Document 18 — MPR-10 HB 750-767_260421_133404.

HEDA lists it separately in the disclosure archive. The report identifies it as ECAB Annual Review of UIO/G Significant Sabotage Leaks. (HEDA Resource Centre)

According to the 2013 review, SPDC did not then possess real-time pipeline monitoring apart from station discharge pressures equipped with high-low pressure-trip settings.

That distinction is important.

A severe rupture can produce a sufficiently large pressure change to trigger an alarm or shutdown.

A smaller leak may not.

The internal review reportedly concluded that major ruptures would activate the station trips but that the average third-party spill would not be apparent from the pressure profile.

This does not mean Shell had no other means of discovering spills.

The company used measures including aerial and ground surveillance, inspections, community information and other operational systems, and Shell says those measures evolved as the theft problem worsened. (Shell)

But those are not the same thing as a real-time leak-detection system capable of identifying an escaping volume of crude promptly.

The internal distinction matters enormously.

A pipeline can leak long before somebody sees the oil

The environmental problem is elementary.

Until an operator knows that a pipeline is leaking, it cannot stop the leak.

Oil continues to move.

The contaminated area can expand.

Creeks can carry pollution farther.

Mangroves, fishing grounds and farmland can be exposed for longer.

The 2026 report therefore argues that weak leak detection and delayed response were likely to have increased the consequences of some spills. It also points out that prompt spill response was required under Nigerian regulation.

That is the report publishers’ analysis.

The disclosed documents do not establish that every delayed response resulted from deficient monitoring.

Access restrictions, security conditions, community disputes, difficult terrain and the time needed to mobilise equipment could also affect response.

Nor does the internal review prove that any particular Bille or Ogale spill escaped detection because of pressure-monitoring limitations.

But the documents establish the underlying technical weakness.

And where a weakness has direct bearing on how long oil may remain flowing, its potential environmental consequence is obvious.

Shell’s sabotage argument makes the document more significant, not less

There is a temptation to treat inadequate leak detection as relevant only where Shell itself caused the initial failure.

That would be mistaken.

Imagine two scenarios.

In the first, corrosion perforates a pipeline.

In the second, an oil thief drills through it.

The immediate cause is different.

But once crude begins escaping, the operator faces the same urgent engineering problem:

detect it, isolate it and stop it.

Shell’s current position is that organised criminal activity was responsible for most of the relevant Niger Delta pollution and that neither Shell nor Renaissance should be held liable for the criminal acts of third parties. (Shell)

That legal argument can coexist with a different operational question.

Was the pipeline system adequately equipped to minimise the consequences after criminal interference occurred?

The internal 2013 answer is uncomfortable.

For typical third-party spills, the real-time pressure-monitoring arrangement was apparently insufficient to reveal the incident.

Foreseeability changes the standard by which prevention should be judged

Oil theft in the Niger Delta was not an unforeseeable event arriving without warning.

By 2012 and 2013 it was a central operational crisis.

Other documents in the HEDA cache show Shell management discussing illegal connections, security problems, production shutdowns, Project Madrid and the huge economic impact of crude theft.

Shell itself publicly reported extensive theft and sabotage.

This matters because risk management is fundamentally concerned with foreseeable hazards.

An operator facing a rare and unprecedented mode of attack might reasonably need time to develop appropriate technology.

An operator facing repeated illegal tapping across a major pipeline system knows that smaller breaches are part of the operating environment.

Once that is known, the relevant engineering question becomes whether surveillance and instrumentation are capable of detecting them rapidly enough.

Shell’s own experts had already said better leak detection was needed in 2012.

A year later, another internal review documented the technical reason.

The words “real-time” matter

There is an important difference between eventual discovery and real-time detection.

A helicopter may see an oil sheen.

A patrol may discover a breached pipe.

A community member may report crude in a creek.

A maintenance team may notice a loss.

All can lead to response.

But by the time visible environmental evidence appears, pollution has already occurred.

Real-time monitoring attempts to identify abnormal conditions as they develop.

That is why the wording in Document 18 is so consequential.

The problem identified was not that Shell would never discover a leak.

It was that the pipeline infrastructure did not possess real-time monitoring capable of detecting typical third-party spills through the available station pressure information.

For a company confronting chronic illegal tapping, that is a major limitation.

Bodo shows why minutes, days and weeks matter

The report illustrates the importance of response time by referring to the two catastrophic Bodo spills of 2008.

Those incidents were different from the third-party spills discussed in Document 18: Shell later accepted that both Bodo spills were operational spills. In January 2015, SPDC announced a £55 million settlement with the Bodo community and said it had accepted responsibility for them. (Shell)

But Bodo demonstrates the consequences when oil is not stopped quickly.

Amnesty International’s earlier investigation reported that the first spill continued for weeks and that the second continued for approximately ten weeks before being stopped. (Amnesty International)

Shell’s 2014 Sustainability Report later acknowledged that the amount released in the two Bodo spills was likely to have exceeded the figures originally recorded in the Joint Investigation Visit reports. (Shell Reports)

Bodo does not prove that the 2012-2013 monitoring deficiencies caused those earlier response delays.

It predates the disclosed assessments and concerned operational failures rather than the typical third-party leakage referred to in Document 18.

Its relevance is narrower and more important:

every hour between the beginning of a leak and its isolation can matter.

That is why detection capability is not a technical footnote.

It is part of pollution prevention.

Shell now says it invested heavily in monitoring

Shell’s current response deserves to be placed directly beside the internal record.

On its present Bille and Ogale case page, updated in July 2026, Shell says its former subsidiary “invested heavily” over many years to reduce spill risk and improve response capability. Shell specifically cites replacement of infrastructure, pipeline monitoring, dedicated spill-response and remediation teams, surveillance, repairs and shut-ins. It says those measures changed as theft and interference increased. (Shell)

That is relevant.

The internal documents concern conditions in 2012 and 2013.

They do not establish what monitoring technology was subsequently installed, when upgrades became operational or how successful later systems were.

It would therefore be wrong to present the 2013 assessment as proof that the same limitation continued indefinitely.

But Shell’s current statement creates an obvious factual question.

When did the deficiency identified internally cease to exist?

The public record should allow that question to be answered.

Shell also rejects the publishers’ interpretation

Before publication of Nigeria: Lifting the Lid, Amnesty International sent its findings to Shell.

On 15 July 2026, Shell responded that the portrayal was not one it recognised and said the organisations had selectively quoted internal documents in a manner that created a misleading impression.

Shell emphasised the difficult Niger Delta operating environment, particularly large-scale oil theft, sabotage and illegal refining by organised criminal gangs. It said its former Nigerian subsidiary worked with authorities, its government-owned partner and local communities and cleaned joint-venture spills regardless of cause as required by Nigerian law. It also stressed that the documents concern complex and contested matters that will be tested through the English litigation.

That response must be reported.

But it does not contradict the actual technical language quoted in the report.

Shell may have further context showing how the risk was managed.

If so, that context is important.

What cannot responsibly be done is pretend the internal finding does not exist.

“Sabotage” answers one question. It does not answer the next one.

Much of the public argument over Nigerian spills has concentrated on causation.

Was a hole drilled?

Was it corrosion?

Was somebody stealing crude?

Those questions matter.

But once a leak begins, another chain of questions starts.

When did Shell know?

How did it know?

How much oil escaped before it knew?

How quickly was the line isolated?

Could the control room detect the pressure change?

Was the pipeline equipped with a system designed to identify smaller leaks?

Was the detection threshold appropriate for the kind of illegal tapping Shell knew was occurring?

Those questions concern consequences rather than initial cause.

The disclosed documents provide disturbing evidence on that second part of the story.

There is an apparent paradox at the centre of Shell’s position

Shell’s defence emphasises the scale of third-party interference.

Document 18 suggests that the system was particularly weak at detecting the average third-party spill through real-time pressure monitoring.

Those propositions can both be true.

Indeed, that is precisely the problem.

The more frequently thieves were breaching pipelines, the greater the need for technology capable of detecting the resulting leaks.

An operating environment dominated by sabotage is not a reason why leak detection matters less.

It is the strongest imaginable reason why it matters more.

What did Shell know from its control rooms?

The internal wording also raises questions about information available to pipeline controllers.

If only a major rupture caused a station trip, what happened during a smaller discharge?

Did the operator continue pumping at normal rates until somebody reported the spill?

Could flow imbalance reveal it?

Did other telemetry exist but not operate in real time?

Were alarms later upgraded?

What threshold distinguished a leak large enough to be detected from one that remained invisible on the pressure profile?

And critically, how many historic spills were first discovered not by Shell instrumentation but by communities, patrols or visible oil?

The documents presently published do not answer those questions.

Shell’s operational records almost certainly could.

Publish the leak-detection history

This is an area where transparency could settle much of the dispute without rhetoric.

Shell should disclose when modern leak-detection systems were installed on the principal SPDC pipelines, what technologies were used, what minimum leak rates they could detect and what performance testing showed.

It should disclose, by year where possible, how spills were first discovered: automated alarm, control-room analysis, aerial surveillance, ground patrol, contractor report, regulator report or community notification.

It should disclose the average interval between first release, detection, shutdown and physical intervention.

It should explain what remedial action followed the 2012 technical visit and the 2013 ECAB review.

And it should state when management considered the finding that typical third-party spills were not visible on station pressure profiles to have been resolved.

If the company rapidly corrected the deficiency, publication would strengthen Shell’s case.

If it did not, the environmental implications deserve examination.

The regulator should possess the same information

NOSDRA describes its role as maintaining zero tolerance for oil-spill incidents and provides formal systems for oil-spill notification, investigation and remediation. (NOSDRA)

The 2026 report cites Nigeria’s 2011 Oil Spill Recovery, Clean-up, Remediation and Damage Assessment Regulations in explaining the importance of prompt response.

Regulatory oversight therefore cannot sensibly begin only after a spill has been noticed.

A regulator responsible for environmental protection has an obvious interest in whether operators possess technology adequate to discover spills promptly.

That makes the history of leak-detection capability a legitimate regulatory issue, not merely an internal Shell engineering matter.

This article does not blame Shell for the thieves

That point is worth stating plainly.

People who illegally tap pipelines bear responsibility for deliberately damaging infrastructure and stealing oil.

Illegal refining caused serious pollution.

Organised criminal activity imposed enormous costs on Nigeria, Shell and Niger Delta communities.

Nothing in Document 13 or Document 18 changes those facts.

Nor do the disclosed documents prove that Shell was legally responsible for environmental damage arising from every third-party spill.

The sharper question is whether Shell did everything reasonably required after the risk of those attacks had become routine and foreseeable.

A pipeline company cannot necessarily prevent every criminal from drilling into steel.

It can decide how effectively it monitors what happens next.

The distinction between cause and consequence

This may ultimately be one of the most important distinctions in the entire Shell Nigeria archive.

Shell has devoted enormous attention to the cause of spills.

The new documents invite equal scrutiny of their duration and consequence.

Even where sabotage is proved, pollution can be made much worse if a leak continues unnoticed.

A criminal can create the hole.

The operator controls the monitoring architecture.

That division of responsibility is why the internal findings are so difficult to dismiss.

In 2012, Shell’s own technical experts said SPDC needed better leak detection.

In 2013, another internal review explained that the pipeline system lacked real-time monitoring capable of revealing typical third-party spills through its station pressure profiles.

Shell now says it invested heavily in monitoring and spill response. (Shell)

The missing piece is the timeline connecting those two statements.

When was the problem fixed?

Until Shell supplies that answer, the documentary record leaves an uncomfortable conclusion.

For at least part of the period when Shell was telling the world that criminals were repeatedly breaching its pipelines, its own experts were warning that the system could not reliably see the typical resulting spill in real time.

If Shell wants the sabotage explanation to carry the full weight it places upon it, then the public is entitled to know how well Shell itself was equipped to limit the damage after sabotage occurred.

That is not blaming the victim of theft.

It is holding the operator of hazardous infrastructure to account for the part of the risk that remained within its control.

Documentary record

The principal evidence comes from two disclosed Shell records.

Document 13 — MPR-10 HB 805-827_260421_132229 is identified in Nigeria: Lifting the Lid as Pipeline Integrity Support Visit: SPDC Port Harcourt, 19-23 November 2012, attributed to Shell Project and Technology. It records the technical assessment that SPDC required better pipeline and flowline leak detection. (HEDA Resource Centre)

Document 18 — MPR-10 HB 750-767_260421_133404 is identified as ECAB Annual Review of UIO/G Significant Sabotage Leaks. The report says it found that SPDC had no real-time pipeline monitoring beyond station discharge pressures and that typical third-party spills would not be visible in those pressure profiles. (HEDA Resource Centre)

HEDA Resource Centre publishes both documents as part of the cache released from the English litigation. HEDA’s Shell document archive

The full coalition report can be read through Amnesty International. Nigeria: Lifting the Lid — full report

Shell’s current explanation of the Bille and Ogale proceedings, including its position on sabotage, monitoring, spill response and the 2027 factual trial, is available on its own website. Shell’s current Bille and Ogale case position

Editorial note

The internal documents establish technical concerns recorded within Shell in 2012 and 2013 about SPDC’s leak-detection capability.

They do not establish that every spill went undetected, that Shell possessed no alternative surveillance methods, that inadequate leak detection caused any specific Bille or Ogale loss, or that Shell was responsible for the criminal act that initiated a third-party spill.

The report publishers infer that poor leak detection and delayed response were likely to have aggravated the environmental effects of some spills. Shell disputes the publishers’ broader portrayal, says the documents have been selectively presented without sufficient operating context and points to extensive criminal interference as well as its investments in monitoring, repairs, surveillance, spill response and remediation.

The relevant factual and liability questions remain contested and are due to be examined further in the English litigation, including the Bille factual trial in 2027. (Shell)

Site wide disclaimer also applies.

^*This website and sisters royaldutchshellgroup.com, shellnazihistory.com, royaldutchshell.website, johndonovan.website, shellnews.net, and shellwikipedia.com, are owned by John Donovan - more information here. There is also a Wikipedia segment, the Shell DPA Files, "Shell and the Spies", the Shell Leaks files, as well as books written and published by John Donovan - Kindle eBooks. Timeline of the Donovan Shell Feud. Toxic History of Royal Dutch Shell Group. Shell and the Donovans: The Full Media Record — 550+ Articles, 110 Books, 40 Years. ^*All created and supported by internet wizz, Nick Gill.