Printed from

Airplane cyber risk takes flight

Posted On: Sep. 1, 2018 12:00 AM CST

Airplane cyber risk takes flight

Flying on airlines is as safe as it has ever been thanks in part to more advanced technology, which has helped to dramatically decrease the incidence of aviation mishaps.

But technology, which has led to airplanes being described as flying computers, creates some nagging worries, particularly about the risk of computer hackers taking control of aircraft, which experts describe as a remote, if dire, possibility.

Experts say the technology for someone on the ground to take control of a plane exists, although it is not in use outside the military.

Recent air disasters, apparently beyond the reach of today’s available technology to avoid, include the still-mysterious disappearance of Malaysia Airlines Flight MH370 and the 2015 Germanwings tragedy when a pilot flew his plane into a mountain, killing all 150 aboard, including himself (see related story).

Meanwhile, there is significant capacity within the aviation insurance market, despite the withdrawal of some markets.

“There’s been a major evolution in cockpit technology and air traffic technology probably since the end of the mid-1990s,” said Eric Donofrio, regional chief underwriting officer for North American aviation for XL Group Ltd., which does business as XL Catlin.

“Basically, what we’ve seen is more computing power onboard the airplane,” which has been a “game changer,” said Mr. Donofrio. “We’ve seen a major drop in loss frequency since the ’90s until now.” In the “old days,” if there was a problem with a temperature sensor, a pilot would inform maintenance, said Mr. Donofrio. Now, however, the information is transmitted “in real time.”

The days of “pilots staring at round gauges” have ended, and they are receiving data on their computer screens on weather, terrain, other aircraft and aircraft operating conditions, including cabin conditions and the availability of oxygen, said Michael Slack, an aviation plaintiff attorney with Slack & Davis L.L.P. in Austin, Texas.

Mr. Donofrio noted also that some airplanes have “envelope protection” systems so that if the pilot tries to fly outside of certain parameters, the autopilot will bring it back in. That system is not focused on suicide issues at the moment, “but I don’t think it’s much of a leap to apply that same concept” to adapt it to that, he said.

In fact, the technology to control a plane already exists. According to the official report issued in July on the missing Malaysia Airlines Boeing 777, Chicago-based Boeing Co. received a patent for such a system in 2006.

The system, “once activated, would remove all controls from pilots and automatically fly and land the aircraft at a predetermined position” and would “prevent anyone on board from interrupting the automatic takeover,” according to the report. But the system has never been installed on an aircraft, the report said.

One reason no one has purchased the technology is its expense, said Mary F. Schiavo, former inspector general for the U.S. Department of Transportation who is now a member of Motley Rice L.L.C. in New York. Another is “they don’t have to” under current regulations, Ms. Schiavo said.

The flip side of this technology’s availability is the concern the wrong people will assume this control by hacking into an airplane’s computer system.

“There’s a danger and there’s also a potential benefit” with such capability, Ms. Schiavo said.

In 2014, a security researcher warned airplane satellite communication systems were vulnerable to hacking through in-flight Wi-Fi. Experts say even if that claim is accurate, a plane’s Wi-Fi and cockpit systems are entirely separate.

However, there is at least some risk of hacking, say observers. As internet connectivity for flight control systems advances, it could create more risk, “but obviously a very big focus of the regulatory agencies is to make sure … the safeguards that block this are going to be very strong,” said Mr. Donofrio.

The Federal Aviation Authority said in a statement in response to a query on this issue that it “has a comprehensive, proactive approach in place to protect the nation’s airspace system from cyber security threats and respond rapidly to those threats,” and works closely with the private sectors to share information and mitigate threats.

However, “It’s a concern, and it’s going to have to be addressed going forward, because there is always somebody working” to hack into a system, said Bradley A. Meinhardt, Las Vegas-based area president and managing director of Arthur J. Gallagher & Co.’s aviation practice.

Joshua Motta, CEO of San Francisco-based Coalition, Inc., a managing general agency that specializes in cyber insurance, who has written software for avionics equipment, said “there is a real risk,” although airplane computers are not typically connected to the internet the way an ordinary computer would be.

But if the chances of an airplane terrorist hacking are extraordinarily low, its severity would be “very high,” and “that’s what would make it such a spectacular risk,” said Mr. Motta.

A related challenge is finding missing airplanes, which is the issue at the heart of the Malaysia Airlines plane’s disappearance. The problem was, “There were only a few pings off a satellite” that gave a clue as to the plane’s location, said Richard May, Seattle-based managing principal for Integro Ltd.

Communications between the aircraft and global positioning satellites depend upon ground-based radar, said Mr. Slack.

It “would have helped immensely” had that not been the case in finding the plane, he said. As it was, investigators “had to make guesses” based on groundbased radar that “doesn’t do well” and long distances over water.

“It is amazing that we’ve got airplanes that fly all over the globe, and there are times we don’t know where those airlines are” because radar’s ability is limited by distance and by line of sight, said Mr. Donofrio.

It “can’t see behind the mountain. There are large portions of the world where we have no air traffic surveillance,” including large portions of Africa, although new radar technology developments are addressing this issue, Mr. Donofrio said.

This problem may be addressed in the future. According to the FAA, aircraft operating in most controlled U.S. airspace must be equipped by January 2020 with “automatic dependent surveillance-broadcast,” or ADS-B, a technology that interacts with satellites rather than radar to more accurately observe and track aircraft, by January 2020.

However, said Mr. Meinhardt, though the ADS-B system communicates with satellites, the satellites must communicate with a ground station, so there are still going to be times where it may be possible “to be somewhere and nobody knows where you are.” It is also possible for the system to be turned off, he said.

ADS-B technology also can address the issue of crowded airspace as the number of airplane trips increases while the number of runways grows slowly, if at all, experts say. The collision risk increases daily, not just for airlines, but for other aircraft as well, said Mr. Slack.

“The more aircraft you have, the closer they’re going to fly together,” said Mr. Meinhardt. “It requires cooperation between the airlines, air traffic controllers and government to manage all the capability.”

While whatever is in the air is regulated by the FAA, airports are typically owned by municipalities, said Mr. Donofrio. Municipalities may encounter resistance from the public in adding airports or runways.

Meanwhile, experts say sensors on airplane engines help monitor potential problems with the engines and improve safety. Computers can “understand and promptly mange system problems,” said Mr. Slack. “Technology is really infusing into aviation at all levels.”