White House Orders Agencies to Defend the Skies From Cyberattacks

Agencies need to step up their efforts to defend the aviation industry against a growing array of emerging threats like cyberattacks and drones, the White House said Wednesday.

In its National Strategy for Aviation Security, the Trump administration called on the government to unify its efforts to combat threats in the country’s airspace. And as the airlines grow increasingly network-connected, agencies must also work to identify and protect against potential vulnerabilities in cyberspace, officials said.

The last national aviation security strategy, which the Bush administration released in 2007, focused mainly on combating terrorism and physical threats posed by criminals and foreign adversaries. According to the White House, this latest iteration aims to expand the government’s defenses against the risks of the digital age.

“The past decade has seen the rise of technologies that generate economic and social benefits, but also may be used to challenge the safety and security of the aviation ecosystem,” the administration wrote. “The use of ‘disruptive technologies,’ such as cyber connectivity and unmanned aircraft, in reckless or malicious ways, along with the constant evolution of terrorist threats to manned aviation, requires a fresh, whole-of-community approach.”

Though terrorists and other adversaries have yet to disrupt U.S. airspace using digital weapons, cyberattacks remain chief among officials’ concerns.

Agencies have seen enemies take an increasing interest in “the systems and networks associated with the aviation ecosystem,” the administration said, and as aircraft and airports lean more heavily on internet-connected devices and offer more broadband and Wi-Fi services to customers, there will only be more vulnerabilities to potentially exploit.

While the worst case scenario is a cyberattack dropping a plane out of the sky, the administration also worries adversaries could hack airports and aircraft to covertly gather information on passengers, companies and even the military.

While the aviation industry long worked to address digital vulnerabilities in aircraft and airports, it’s unlikely they totally equipped to combat latest threats, said Marty Edwards, director of strategic initiatives at the International Society of Automation.

“Significant care must be taken when integrating computerized, networked aircraft systems in order to ensure appropriate separation and protection from cyberattacks,” Edwards, who formerly led the Homeland Security Department’s Industrial Control Systems Cyber Emergency Response Team, said in an email to Nextgov. “I am confident that manufacturers and airlines alike are aware of the potential issues. However, I am also concerned that vulnerabilities that they are unaware of may exist that could be exploited by skilled attackers.”

The White House also highlighted the potential threats posed by the 7 million commercial drones expected to be in the air by 2020. The government has already seen unmanned aircraft used to smuggle drugs, weapons and money, the administration said, and drones could become an even greater problem if they’re used for reconnaissance or equipped with explosives.

To address emerging threats in the cyber and physical world, the White House pressed agencies to collect and share more information on potential threats, work to proactively identify new risks and build a “layered security” plan with help from industry. Led by the Homeland Security Department, the government will also work to boost its ability to quickly respond to attacks on the aviation industry.