Within aviation security, mitigating measures must be sustainable

Our security roundtable, consisting of three highly-regarded individuals within the security sector, summarised that security threats should be seen as an opportunity for the aviation industry to learn, develop and cement its place in the travel sector’s future.

Participants:

David Ryder, Head of Aviation Security, ACI EUROPE	Ricardo Fernandes, Facilitation and Security Bureau, Portuguese Civil Aviation Authority	Frank Schiliro, Superintendent, Australian Federal Police

What is the biggest concern affecting the aviation industry at this time?

Ryder: Overall the biggest issue for airports (and aviation in general) is the need to grow their business in a sustainable way. For aviation security it is similar – the measures designed to mitigate threats should be sustainable. This means that new technology should be future proofed as much as possible; rather than buying new equipment for every new threat, current advanced equipment should be upgraded (normally by adjusting algorithms) to meet said new threats.

Fernandes: The aviation industry is a global activity that necessarily depends on the success of air transport as a safe and secure way to travel. The future success of air transport is deeply linked with how the civil aviation sector will deal, not only with the expected passenger traffic growth in the medium and long term, but with changing passenger expectations that demand speedy and user-friendly services, similar to which they receive in their day-to-day life.

For aviation security it is similar – the measures designed to mitigate threats should be sustainable (David Ryder, Head of Aviation Security)

The interconnection between traffic growth, providing appropriate responses to passenger expectations and ensuring air transport is a safe and secure way to travel, presents itself as the biggest concern/challenge that aviation industry is currently facing. The current pressures on securing efficient security systems will increase in order to make the aviation industry more flexible and able to response to the future civil aviation market demands. The aviation industry must deal with this challenge but cannot give in to any easy solutions that will compromise safety and security.

The current and future challenges should be seen not as a concern, but as an opportunity for the aviation community to discuss and find solutions. Developing aviation safety and security systems – and the management of threat evolution – are important values for the aviation industry that can contribute to improving international air transport connectivity, tourism and economic growth.

Schiliro: From my policing perspective, I see that as the aviation industry moves to become more efficient and effective, whilst driving costs down, it can be anticipated that technology will become a significant enabler: For example, the Internet of Things and artificial intelligence. However, this will present serious cyber-security concerns.

How can airports ensure their security measures remain effective?

Ryder: Regulators need to revise and refresh their threat assessments regularly. At the same time, airports should keep their security measures under review and amend and adjust them to take account of the revised national threat assessments. 

Fernandes: An aviation security (AVSEC) system of an airport is a complex and interconnected system of measures and material resources, with the goal to protect the airport and the civil aviation against acts of unlawful interference.

To achieve this goal, an airport should be adequately endowed with the necessary resources for a proper and effective implementation of all security measures that mitigate the risks posed by the current and evolving threats to civil aviation.

An effective and efficient security regime must be supported by appropriate risk-based security measures applied and recognised between airports, through mutual recognition, without undermining the baseline standards that the ICAO Annex 17 continue to provide. In addition, an effective security system can only be successful if people are accountable and motivated to follow established procedures, comply with prescribed regulation and take the initiative when unforeseen circumstances arise.

To ensure their security measures remain effective, an airport AVSEC system should integrate the local specificities and manage their local complexity based on the evolving threat picture, without compromising the baseline standards, which are the basis for efficient and secure international connectivity of air transport. The effective implementation of security measures will also depend on the implementation of an strong and robust security culture in the airport environment, that will result in personnel, from the top management to all the other employees – in both security and non-security functions – thinking and acting in a more security conscious way, which supports and maintains a risk-resilient organisation; mitigating both insider and external threats.

Schiliro: I see airports as a microcosm of community policing. Policing has many strategies that focus on building and working closely with members of the community. To ensure security measures remain effective, airports need to be engaged with policing. For example, airport watch, insider threat programmes, intelligence sharing and global airport conferences to share lessons learnt and new ideas.

Which area within an airport demands the most attention when considering security measures?

Ryder: People are the most important part of the security jigsaw puzzle, but sometimes the most difficult to manage – there is a need for an embedded security culture at all levels and across all functional areas and in all entities that work at an airport. It is important to have leadership from the top that can motivate a workforce to remain alert at all times.

Fernandes: An airport AVSEC system is comprised of several subsystems ranging from passenger and staff screening to the implementation of a secure supply chain for air cargo and mail, in-flight supplies and airport supplies. These subsystems ensure the effectiveness of the various security measures acting as interdependent security layers. The failure of one of these subsystems could undermine the effectiveness of the entire airport AVSEC system. An airport AVSEC system needs to be managed in a holistic manner, not concentrating on the available resources in one subsystem or on mitigating the risks posed by a specific threat.

The available resources should be managed in an efficient, proportional and effective manner to guarantee that each subsystem is provided with adequate resources. It is difficult to refer only to one area or subsystem that needs the most attention when considering security measures, however, there are areas that airports should focus their urgent attention, resources and efforts on, namely enhancing their risk awareness and response time; the development of security culture and human capability; the improvement of technological resources and innovation; the improvement of oversight and quality assurance; and the increase in cooperation and support from all stakeholders, with the shared and common goal of enhancing aviation security.

Schiliro: In regard to airport security we always refer to three distinct areas: Kerbside (outside the terminal), landside/front of house (inside the terminal) and airside (the part of an airport nearest the aircraft, past security and screening checks).

All three areas should demand attention, however with the ever tightening of security in relation to airside, the easiest target for terrorist activity would be landside. This has been witnessed in several attacks, for example the Brussels Bombing in 2016.

Do you think keeping airports safe will get harder with time?

Ryder: No. It will never be easy, but airports can and do take a proactive approach to improve their mitigation measures, which is fundamental for a safe and secure environment to ensure business continuity and passenger satisfaction.

Fernandes: Following what I already mentioned, I do not think that it will necessarily be harder to keep airports secure in the future. However, taking in to account the current and future aviation industry challenges, linked with expected traffic growth, changing passenger expectations and ensuring the effectiveness of security measures without compromising efficiency, keeping airports secure will certainly be more challenging for those managing the AVSEC systems. They will have to deal with a greater number of variables, such as increasing knowledge of threat natures and risk levels, implementing effective and sustainable security measures and ensuring a robust security culture capable to fostering behaviours that contribute to the effectiveness of the AVSEC system.

Schiliro: Airports are continually evolving, as vulnerabilities, threats and risks are better understood and mitigation strategies are developed to counter the security issues, airports are becoming more secure. However as new vulnerabilities and threats present themselves, for example technology enablers and cyber-security, there is always, and always will be, concerns regarding the security and safety of airports.

To what extent do inside threats need to be considered in comparison to outside threats?

Ryder: Both need to be considered in tandem. All the technology and processes put in place to prevent outside threats come to nought if an insider sidesteps the technologies and procedures. 

Fernandes: The insider threat and the outsider threat are directly related. All threats to civil aviation must be properly assessed and the AVSEC systems must be adequately endowed with the resources to mitigate risks.

The insider threat arises internally in civil aviation, specifically through its employees, whose knowledge, functions and privileged access to secure areas give them a tactical advantage for planning, preparing and perpetrating acts of unlawful interference. The specific vulnerability of aviation to attacks involving the use of insiders in order to by-pass security controls need to be reflected in risk assessments and mitigation measures.

The insider threat should not be considered as a separate category in comparison to outside threats but should be considered as one dimension of each particular threat type, resulting in the risk assessment involving both personnel security requirements and physical security measures. These should include background checks, physical measures, training and awareness and reporting mechanisms, with the aim to create a multi-layered security regime involving complementary measures which in combination compensate for the limitations of each individual measure and avoid single points of failure.

Schiliro: The criminal mind is constantly coming up with creative and new ways to achieve an outcome. As security and screening methods become more impenetrable, the insider threat issue, which may be seen to present an easier path, will be explored and exploited to continue achieving the criminal outcomes. For example, the transportation of illicit goods through airports and terrorist activities.