UN aviation body ICAO will recommend creating a cyber security task force at a meeting next week in Canada. A task force is needed due to an increasing reliance on interconnected IT systems with operating systems such as Microsoft Windows and Linux, and protocols such as IPv6 and Avionics Full Duplex Switched Ethernet (AFDX). A recent paper from the ICAO noted that the current pace and extent of new information technologies is notably increasing the risk from cyber attacks.
The real worry is in ADS-B (automatic dependent surveillance broadcast), the next-generation protocol used by air traffic control systems to track aircraft positions, which has been adopted in Australia and in the US. It allows for more precise aircraft tracking, which allows more planes to fly closer together.
The problem is that it is possible, with US$1,500.00 of equipment to tamper with the ADS-B tracking data for planes in the sky and also make planes that aren’t flying appear to be in the sky to air traffic controllers. The equipment needed for such an attack costs as little as US$1,500. The weaknesses in ADS-B have been known for years and the cost for deleting these weaknesses will be both huge and time consuming. A cyber attack tomorrow could shutdown vast tracts of airspace and cause a situation very similar to that seen during the Icelandic volcano incident of April/May 2010 which could sink airlines into the red and cause untold economic damage.
Everything is at risk from deletion of maintenance records to the jamming of GPS signals around airports. In one example from the ICAO: Three software engineers were accused of sabotaging code in June 2011 at a new airport terminal, allegedly because they didn’t get a pay increase from a subcontractor. Three days later, check-in services failed at the terminal, with 50 flights delayed.
A disgruntled airline passenger sitting at home with $1.5k of kit through to a knowledgeable and well-financed terrorist, when it comes to cyber attacks the distinction can be limited at most. Airlines will need to spend further to protect information and systems, and air traffic control and airfield owners right through to parts suppliers will have to become more militarist in their thinking to ward off the inevitable attacks.
Please check out The Risk Universe magazine (www.riskuniverse.com) and look to Aviation Risk magazine in 2013 (media kit available) for regular updates and commentary from the top specialists in the risk sphere, of which only this company can boast experienced and active risk specialist editors and aviation editors – No other aviation publishing company has the expertise to launch such a publication existing in-house, thus only we can offer independent information on the matter of the expansive risk sphere with full knowledge of and distribution to the airline sector. Look out for this high-end journal – The content applies to you all no matter what your business is.
