Airline industry swooping in to prevent cyberattacks

November 8, 2013 by Paresh Dave

Worried that computer hackers attacking banks and media companies could easily shift targets, the airline industry is taking preemptive steps to ensure it doesn't become the next victim.

Although the "hacking" of planes midair to bring them down is unlikely, many networks, including airline reservation systems and airport parking meters, could be vulnerable to cyberattacks, which could disrupt air travel, weaken travelers' confidence and deal a major blow to a fragile economy.

"The aviator guys are getting together because they see what's going on in every other sector," said Paul Kurtz, chief strategy officer for computer security firm CyberPoint International. "It's just a matter of time before the bad guys start wondering, 'How do we start making money off attacking the aviation industry?' "

New technologies and tighter budgets have added to the complexity of safely transporting 2.6 billion air passengers a year worldwide. But officials at , airports and aircraft makers believe they can develop enough safeguards to limit the effects of hackers.

Boeing Co., which by the nature of its business has always focused on aircraft safety and reliability, is now also stressing network and computer systems security. Worries about defects such as hydraulic leaks have been brought up alongside concerns that a miscreant could surreptitiously inject malicious commands somewhere in the 18 million lines of that help power its latest jet, the 787 Dreamliner.

"I know the media worries about the kid in seat 14B on his laptop hacking the flight controls," Michael Sinnett, Boeing's vice president of product development, said at an industry conference this summer. "I'm here to tell you that's not going to happen. But the question is, 'Do I have to worry about a guy inside my system for four years before the code even hits the streets?' "

Most of the code is written by Boeing contractors, and Boeing and aviation regulators test for errors. Even afterward, Boeing assumes programs will do something unexpected and prepares backup plans.

For pilots, large suitcases filled with instruction manuals have been reduced to laptops and, more recently, tablet computers. Weather updates and other flight-related information - once relayed via or paper printouts - are increasingly beamed by Wi-Fi and the new NextGen air traffic control system directly into the cockpit.

Kurtz said protecting those links is relatively easy in the U.S.

"But somewhere in Asia or Africa, the updates and maintenance might not be as (buttoned-down)," he said.

Yet not all airports in the U.S. are ready to guarantee secure connections for airlines. LAX has been among the large airports at the forefront of strengthening defenses through education and monitoring.

But Dom Nessi, LAX's , said that the airport doesn't offer airlines a dedicated connection because "we don't think we can give them a secure service."

Like other airports, LAX remains a juicy target for hackers. A phishing attack in late June and early July tried to deceive airport employees into opening fraudulent emails, Nessi said.

The airport's cybersecurity investigators said the "highly targeted" emails encouraged users to download files that when opened could have given the remote attacker "complete control over the victim machine," including the ability to monitor their Internet browsing and email.

The experts traced the attack to a foreign government, Nessi said. Phishing emails have led to several major cyberattacks, including one that led to a New York Times website outage for two days in August.

"Every day a new threat emerges, so you have to build an organization that evolves and evolves rapidly," Nessi said.

The two Washington, D.C., area airports recently began rigorous testing of computer networks and teaching employees about protecting their computers from hackers, said Martha Woolson, information technology security manager for the Metropolitan Washington Airports Authority.

Woolson said a year and a half ago several employees fell for a phishing email designed to look like one sent by US Airways. During a recent wave of phishing, more than 30 airport workers came to her for advice when they received the email.

Woolson has gone as far as distributing magnets with a simple warning, "When at work, don't go to any site that would embarrass your granny."

Cybersecurity experts suggested that airlines and airports must expect that hackers eventually will shut down crucial systems. Having a strategy in place to quickly recover is essential, they said.

"Many airlines are worried about hackers but have no idea where to start," said Joe Ayson, senior director for aviation cybersecurity firm AvIntel. "Our goal as a practice is to ensure there's a constantly revised mitigation process in place that's an actual living, breathing part of operations."

He recounted the recent experience of an airline in Africa whose reservation system had been sputtering for six weeks. The airline didn't realize it had been plagued by a computer virus. Ayson's team found ways to keep the airline running despite the issues.

Peter Andres, vice president of corporate security for Deutsche Lufthansa AG, said being a "sexy" industry heightens the challenges.

"There are so many people who love to play with simulators, who listen to controls, who really study this stuff," Andres said. "But that of course gives more transparency and tools to people who have malicious intent."

Airlines, airports and aircraft makers see themselves at a crossroads. The sooner they can show that computer-related threats have been minimized, the more likely the industry won't face additional government regulation.

"It's the kind of homework that's been long overdue," Andres said.

About the only regulation desired by the industry is legislation protecting airlines from liability and lawsuits if they share information about "hacks" with one another and the government.

To be sure, airlines run the risk of overreacting about the risks of technology. Boeing's Sinnett compared cybersecurity with lightning. Every plane is struck by lightning once a year, he said to conference attendees. But Boeing doesn't expect a plane to get hit by a dozen shocks at once.

"You account for it as much as you can and reduce its impact," Sinnett said. "It's not perfect physics, but it's a black art."

Explore further: Widespread flight delays hit United Airlines

Related Stories

Widespread flight delays hit United Airlines

August 28, 2012

United Airlines passengers were stranded at airports around the United States for hours on Tuesday due to network outages that affected its airport and website operations.

American Airlines fixes computers, delays go on

April 16, 2013

American Airlines says it has fixed an outage in its main reservations system that is disrupting travel for thousands of passengers whose flights have been delayed or canceled.

Foreign airlines urged to use GPS at San Francisco (Update)

July 29, 2013

U.S. aviation officials have advised all foreign airlines to use a GPS system instead of visual reckoning and cockpit instruments when landing at San Francisco International Airport in the wake of the deadly Asiana Airlines ...

Several airlines see delays from computer outage

August 6, 2013

Several airlines are experiencing flight delays nationwide because of a problem with a computer system they use for services such as reservations, check-ins and online booking.

EU climate chief revives airline carbon tax proposal

October 16, 2013

The EU's top climate-change official said Wednesday that Brussels was within its rights to tax airlines for emissions in its airspace, reviving a controversial proposal that drew a storm of criticism.

Recommended for you

Roboticists learn to teach robots from babies

December 1, 2015

Babies learn about the world by exploring how their bodies move in space, grabbing toys, pushing things off tables and by watching and imitating what adults are doing.

Xbox gaming technology may improve X-ray precision

December 1, 2015

With the aim of producing high-quality X-rays with minimal radiation exposure, particularly in children, researchers have developed a new approach to imaging patients. Surprisingly, the new technology isn't a high-tech, high-dollar ...

Making 3-D imaging 1,000 times better

December 1, 2015

MIT researchers have shown that by exploiting the polarization of light—the physical phenomenon behind polarized sunglasses and most 3-D movie systems—they can increase the resolution of conventional 3-D imaging devices ...


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.