U.S. Steps Up Scrutiny of Airplane Cybersecurity

The new U.S. program is trying to ensure that hackers can’t exploit potential vulnerabilities in electronic systems of new and old airliners. The scrutiny comes after cyberattacks that, in recent years, have attempted to disrupt such internet-connected sectors as energy grids and electoral systems.

The U.S. Air Force separately plans to take a bigger role in examining the security of systems used in commercial aviation. Many of the systems are also used by the military. “If we don’t probe first, our adversaries will,” Will Roper, the service’s assistant secretary for acquisition, technology, and logistics, said in an interview. “We’ve been a little complacent in not trying to attack all of the parts of the airplane.”

Cyberattacks against airlines have targeted weaknesses in information-technology systems rather than aircraft. British Airways is facing a $230 million fine in the U.K. after about a half-million passenger records were accessed during a 2018 cyberattack. Air Canada and Hong Kong’s Cathay Pacific also reported data hacks last year.

“There are many risks in aviation beyond looking at the aircraft,” said

Jeffrey Troy,

president of the Aviation Information Sharing and Analysis Center, a nonprofit industry organization focused on cybersecurity. “It’s very important to be looking at the whole ecosystem and identifying key points where a digital system, if it were to malfunction, could cause a bad day for a lot of people.”

The Air Force operates more than 5,300 planes—including converted airliners such as the Boeing 747, the model used as Air Force One when carrying the president. The service has used internal teams to probe its systems and look for potential weaknesses adversaries could exploit. Mr. Roper said he wants the Air Force to look with more urgency for cybersecurity weaknesses.

The Air Force sent 28 people to Defcon, the annual hacking convention, in Las Vegas this year to participate in its first-ever dedicated “hacking village,” where researchers could try to find vulnerabilities in aviation systems.

Stefan Savage,

a computer- science professor at the University of California San Diego, said it is important to have more outside scrutiny of aviation cybersecurity because manufacturers aren’t always willing to own up to security problems, especially when fixing them would be costly.

“Beyond trusting Boeing, who’s the backstop?” he said. Mr. Savage is on a team of researchers who assembled a test bed containing many of the systems found on a Boeing 737 to carry out security testing.

Handling the sensitive information such tests can highlight is tricky. The plane-testing component of a Department of Homeland Security effort, called the Avionics Cybersecurity Initiative, was cut short last year amid a disagreement with

Boeing
Co.

over the testing methodology and plans to publicly release some findings.

DHS said as part of that initiative it had acquired a used Boeing 757 airliner in 2016 and spent more than $10 million to identify potential cybersecurity vulnerabilities. Program administrators had planned to run 15 cybersecurity tests on the approximately 30-year-old jet. But the plane hasn’t been touched in more than a year because of the disagreement over some of the program’s early findings.

The program’s manager,

Rob Hickey,

a former Air Force pilot, described some of the findings at a November 2017 aeronautics cybersecurity conference, saying testers were able to access some of the airplane’s systems using radio frequency communications, according to a report in the trade publication Avionics International.

Boeing, which disputed some of the findings, felt blindsided by Mr. Hickey’s disclosure, according to current and former DHS officials, and testing of the plane’s systems was put on hold. “We had some disagreements about some of the specific tests. We had to work through those,” one official familiar with the program said. “There were valid points on both sides.”

Mr. Hickey said in an emailed statement he hopes the DHS resumes the testing protocol that his team developed “for the good of all—especially the flying public.”

Boeing said it supports the reconstituted cybersecurity initiative and may participate at next year’s Defcon conference. “We need to bridge the gap between the hacking community and the industry,” an official said.

Write to Robert McMillan at Robert.Mcmillan@wsj.com and Dustin Volz at dustin.volz@wsj.com

Comments are closed.