Europe Sets Up Digital ‘SWAT’ Team for Aviation Cyber Threats
European aviation agency’s team would identify and combat potential hacking attacks
Intended to be a kind of digital SWAT team for hacking attacks, the initiative launched last month goes beyond U.S. efforts and is the most dramatic example of the European Aviation Safety Agency’s increasingly aggressive approach to such risks.
The aim is to quickly provide technical assistance to carriers or national regulators anywhere in Europe in the event of a cyber attack, Patrick Ky, the agency’s executive director, said in an interview.
The move is also part of a broader campaign by the agency, which serves 32 member states, to expand its authority beyond traditional safety regulations. "We think the aviation system is quite vulnerable to cyber attacks,” Mr. Ky said.
Aviation authorities world-wide have said there hasn’t been a verified instance of an individual or a group successfully hacking into a commercial airliner’s power or flight-control systems while airborne. But, like many experts, Mr. Ky worries about growing potential threats as aircraft become more connected to ground-based computer networks, ranging from maintenance to navigation to cabin entertainment.
Mr. Ky said he has started to recruit cyber experts with the aim of reassuring political leaders and passengers that “we are ready and we are going to help” if aviation computer systems are compromised. The team will be supplemented by staff loaned from various national regulators.
He added that France, the U.K. and a number of Scandinavian countries have pledged to assist with the policy, and that he discussed the concept earlier this week with Peggy Gilligan, the top safety official at the U.S. Federal Aviation Administration.
Initially, the focus will be on cataloging and monitoring cyber-related hazards confronting commercial planes and other aircraft world-wide. But by late 2016, according to Mr. Ky, a core team of roughly a dozen troubleshooters should be ready to respond to specific incidents. He envisions 50 or 60 experts will eventually be dedicated to such work.
Leaders of EASA and the FAA have previously talked about cooperating on more-stringent design standards to insulate flight-controls and other safety-critical systems from potential cyber attacks. Each agency has asked its own phalanx of industry officials and outside experts to come up with recommendations.
But the U.S. and Europe are at odds over some principles, especially when it comes to the best way to safeguard smaller, private aircraft. Even if a joint approach emerges, sweeping regulations or legislation could take years to become final.
Rather than simply wait for that process to end, Mr. Ky and EASA’s policy-setting management board are intent on ensuring that timely, detailed technical assistance will be available to deter or minimize the impact of any computer breach.
“The aircraft when it’s flying, is quite immune” to such threats “at least for the time being,” according to the EASA chief.
But he said he is more worried about maintenance functions and other ground- based systems that can tap into onboard computers. “The risk is there,” he said.
Mr. Ky, who took over the agency more than two years ago, is now pushing to get certain security, operational oversight and aircraft-inspection responsibilities previously reserved for aviation regulators from individual countries. He has already shaken up the bureaucracy and clashed with some airline officials by moving into areas once considered strictly off-limits for the agency.
His campaign to broaden the agency’s purview will be debated by European legislators and politicians in coming months. Last year, the European Commission concluded that threats to “cyber security are increasing and may require new approaches to certification” of aircraft and major components.
Precisely how EASA will proceed, and what additional resources it will have, are expected to be a big part of the impending debate.