Faraz Nasir, Risk Analyst at G4S Risk Consulting – a member of the British Security Industry Association’s Specialist Services Section - gives a comprehensive overview of the aviation industry’s current climate.
A series of recent high-profile aviation security incidents have focused scrutiny on the aviation industry. The economic and political role of commercial aviation makes airports, aircraft and supply chains a highly desirable target for new, unconventional opponents, such as terrorists, insurgents and single-issue groups, as well as facing political and environmental risk. Threats are best mitigated by thorough risk assessment within a wider risk management framework, incorporating the gathering of reliable and actionable intelligence to enable effective regulations and security measures as part of a duty of care for customers and employees.
• Technological advances, the proliferation of weapons of mass destruction and the emergence of terrorism as a global phenomenon have enabled threats to the aviation industry to increase in reach, frequency and intensity.
• Geopolitical tension, terrorism, bouts of civil unrest and economic and political developments pose significant risks, particularly to global airline alliances, with airlines facing a further burden of enhancing and improving their occasionally disparate operations divisions.
• Aviation is a global enterprise with a distributed infrastructure and multiple access points. Successful attacks can inflict casualties and grave economic damage, attracting global attention and damaging investor and consumer confidence.
• Risks to the aviation sector can be mitigated through analysis of political, security and business risks, a comprehensive risk assessment and the effective design, implementation and management of security plans and procedures.
The downing of Malaysian Airlines flight MH17 in July 2014 by suspected rocket fire from pro-Russian separatists in Ukraine highlights an emergent threat from armed groups. Despite several historic incidents of civilian aircraft being downed by military aircraft or surface-to-air (SAM) missiles, most resulted from mistaken identification or opportunist attacks using MANPADs (man-portable air-defence systems). Weaponry capable of reaching 30,000ft, including vehicle-mounted radar homing missiles, had been considered unobtainable for use by militant groups. More than 40 civilian planes have been hit with ground-based missiles in conflict zones since the 1970s, but have involved small aircraft flying at low altitude. Ground conflicts are not necessarily a direct threat to the skies above and most have little impact on commercial flights. However, the downing of MH17 prompts concern that armed groups in conflict zones such as Iraq, Syria, Libya, Mali and Afghanistan could present a credible threat to commercial airlines should Buk-type missiles also fall into their possession. Airlines and regulators must consider whether armed groups in these areas possess the sophisticated weaponry required to down an aircraft and their motivation and capacity to use such devices.
No fail-safe countermeasure
Israel’s El Al is to be the first airline to equip commercial aircraft with limited defence measures, but systems such as the Directed Infrared Countermeasure (DIRCM) fitted directly onto an aircraft are too expensive for wide application. The most effective countermeasure for commercial airlines is to avoid flight paths over conflict zones where armed groups are in possession of surface-to-air missiles. However, with different advice offered and followed by regulators and airlines, there is no global standard. The International Civil Aviation Organisation (ICAO) had issued a hazard warning up to 32,000 feet for the east of Ukrainian airspace following an escalation of military air operations, but MH17 was flying at 33,000 feet when it was hit.
Commercial flight routes are well established. Modifying flight procedures can reduce safety margins, burn fuel and may be unnecessary. The ICAO coordinates international efforts and requires national civil aviation authorities to be responsible for reviewing the threat level in their state. Reliable, actionable intelligence and threat analysis is critical to identify potential conflict hotspots before they emerge as a credible threat. Aviation security programmes should be adjusted according to risk assessments, including regular liaison between regulators and airlines to develop risk mitigation measures. Airlines should also consider the voluntary sharing of intelligence.
The threat of terrorism impacts on travel and business, with states such as Afghanistan, Pakistan, Iraq and Kenya facing a high risk. Several ongoing conflicts mean terrorist interest in attacking the aviation industry is unlikely to dissipate. The terror threat evolves as intentions and capabilities change and countermeasures are implemented. Techniques are adapting, including the modality of planning, complexity of attack and style of execution. The type, location, and frequency of attacks cannot be reliably extrapolated from historical patterns, meaning current threats must be regularly reassessed, particularly in challenging environments.
Islamist militants typically target civilians, government or foreign assets, damage infrastructure and seek global media coverage. The trend towards targeting airports, crew and offices has increased over the past decade due to enhanced security measures making access to aircraft difficult and has resulted in a shift in modus operandi toward smaller-scale, opportunistic attacks. Airport security forces are now required to address the threats of firearms, bombs, suicide bombers and hijacking. Enhanced airport perimeter security rests largely on fences, cameras and alarms. However, such measures are expensive and in higher-risk environments, vulnerabilities will exceed resources where there is no guarantee of providing an adequate deterrent. Terrorist groups are continually devising other methods of infiltration and assessing weaknesses to exploit in any countermeasures. The development of allegedly undetectable explosive packages is forcing officials to ask passengers to prove that electronic devices have power.
Perimeter breaches continue to occur sporadically at airports, including at New York’s John F. Kennedy International Airport (JFK), but the threat is exponentially greater at airports in high-threat environments. Responsibility therefore falls on the timely collection and dissemination of intelligence to counter terror threats before they emerge, aided by adequate access control procedures to ensure ID and area permissions are strictly enforced.
Insider threat poses a primary focus of attack
The potential for an insider threat is greatest at airports with limited governance capability in low-income economies. The ability of countries in sub-Saharan Africa and South Asia to effectively screen prospective airport employees is hampered by poor and incomplete intelligence databases. Nevertheless, the US is not immune to breaches and individuals with ties to street gangs have gained employment, using their position to engage in drug trafficking and baggage theft. The African Civil Aviation Commission (AFCAC) notes that security breaches committed at most airports have the direct or indirect involvement of airport staff, including the surveillance of sensitive areas, disclosure of sensitive security information and the bypassing of security checkpoints. Potential threats range from a disgruntled employee to those with nationalist, monetary and ideological motivations.
Airlines can make a significant contribution to countering insider security threats through rigorous personnel security practices. However, regulatory agencies, airport authorities and the airlines themselves must continually review their approach. Despite adding to airline operating costs, gaps still exist within airport systems, which could harbour insider security threats ranging from vendors to security personnel.
Political and Business Risk
The financial crisis in 2008 and the Arab Spring in 2011 shifted the political and business risk environment. In advanced economies, governments are faced not only with socio-economic inequalities, but also high levels of sovereign debt, which has been exacerbated by the recent Eurozone crisis. Elsewhere, state action and unrest pose a direct threat to business continuity, evidenced by the aviation industry’s sensitivity to fluctuations in fuel prices. Lax safety standards and a poor regulatory regime also expose companies to risk, particularly in Asia, which has experienced considerable aviation growth in recent years. In Indonesia, such factors contributed to a series of major incidents and aircraft losses during the 2000s, forcing company executives to change their behaviour after some 50 Indonesian airlines were banned from EU airspace.
Uncertainty can be managed. Airlines that invest in developing political capabilities, resources and risk mitigation strategies are better placed to sustain competitive advantage, despite operating in challenging environments.
Environmental risks often fall outside of airline control
Environmental disasters, including tsunamis and volcano eruptions, can impact operations for an indeterminate length of time, as witnessed with the Bardarbunga and Eyjafjallajokull eruptions in Iceland in September 2014 and 2010, respectively. Access to appropriate detection technology can help airlines to determine whether levels of ash in the atmosphere are safe enough to fly in. Advanced warning systems, along with business continuity planning, can mitigate the commercial impact.
Medical risk increasingly mitigated through avoidance
Airlines are becoming more risk-averse in cancelling routes to areas affected by transmittable diseases, particularly when national authorities request flight suspensions. Since late July 2014, airlines have cancelled more than a third of international flights to Sierra Leone, Liberia and Guinea over fears that an outbreak of the Ebola virus could spread. This is in spite of the World Health Organisation (WHO) urging airlines to keep routes operational, given aviation constitutes a low risk for Ebola transmission. There has been only one known transmission via air travel and airlines are asked to assist in screening and notify authorities if they suspect Ebola cases. Ebola is just the latest medical outbreak to affect airlines, following the respiratory virus SARS in 2003 when airlines issued masks and MERS in 2013/14.
Civil unrest requires a dynamic understanding of threats and vulnerabilities
Civil unrest and disturbances pose risks for most businesses, with impact varying by event, proximity and business sector. Airport expansion and the environmental impact of flying have triggered a number of anti-aviation campaigns by environmental activists such as Plane Stupid, HACAN Clear Skies and Greenpeace, who notably established a climate protest camp at London Heathrow (LHR) in 2007. All stakeholders in the aviation sector need to provide specific situational awareness, engage in comprehensive risk assessment and implement mitigation measures in the face of evolving security challenges.
The downing of MH17 has changed the risk landscape for airlines and airport authorities. From both a consumer and government perspective, ensuring security of aircraft and airport facilities will become a more inclusive and international process. Policy and resource-allocation decisions will ideally be at the discretion of aviation security agencies, who are best placed to tailor policies and mitigation measures to changing threats and different situations at individual airports which vary in size and configuration. Airlines and supply chains will increasingly need to understand political, security and business risk in specific locales, in addition to transnational routes.
The BSIA’s Specialist Services Section consists of members that offer specialist services including Close Protection, Technical Surveillance Counter Measures, Surveillance, IT Forensics, Cyber Security and Security Consulting including Critical National Infrastructure. Members of the section can assist security buyers with specialist and challenging requirements both in the UK and internationally, such as maritime security, penetration testing and critical national infrastructure protection.
Faraz Nasir’s full report, with associated case studies, can be found on G4S Risk Consulting’s Global Intelligence System (GIS) here.