Why ‘security thinking’ has never been more important

The aviation industry is slowly emerging from the worst crisis in its history. For some, full recovery to pre-pandemic traffic levels will still be a long road but, for others, traffic is back but the labour force has not fully returned. As a result, skills and knowledge may have been lost to other organisations. In the best of cases, airport workers are coming back to work after a prolonged absence and may need extra training and refreshers.

This poses a challenge to airports as they seek to maintain the highest levels of safety and security. While it may appear that health and hygiene have become priorities, this is not new. Health forms part of what aviation has always valued and excelled at – and that is protecting the safety, wellbeing and security of travellers and staff. Health should not be perceived as an additional competing priority, but be embedded in our existing organisational cultures and strategies

The aviation industry is slowly emerging from the worst crisis in its history. For some, full recovery to pre-pandemic traffic levels will still be a long road but, for others, traffic is back but the labour force has not fully returned. As a result, skills and knowledge may have been lost to other organisations. In the best of cases, airport workers are coming back to work after a prolonged absence and may need extra training and refreshers.

This poses a challenge to airports as they seek to maintain the highest levels of safety and security. While it may appear that health and hygiene have become priorities, this is not new. Health forms part of what aviation has always valued and excelled at – and that is protecting the safety, wellbeing and security of travellers and staff. Health should not be perceived as an additional competing priority, but be embedded in our existing organisational cultures and strategies

The good news is that airports are taking on board the lessons that have come from the crisis. In fact, their resilience in the face of adversity has been impressive. Wendy Reiter, Director, Security and Emergency Preparedness at the Port of Seattle talks of a ‘COVID nudge’: “When traffic dropped, we took the opportunity to get back to the basics of security. We looked at the vulnerabilities we faced, the regulatory environment we worked in, and we focused on what is important and what makes sense. This led us, for example, to close perimeter gates that were not needed, review how we inspect concessionaires’ goods and how people go from the public to the sterile area. It also allowed us to explain to stakeholders why we are doing what we are doing.”

Security culture

Security remains a priority, but maintaining this focus at every level has never been more challenging. Seen under this light, the International Civil Aviation Organization’s (ICAO) decision to declare 2021 the ‘Year of Security Culture’ was the right one. Security culture, like safety culture, are concepts which are hard to pin down. Culture is often defined as a set of norms, beliefs, values, attitudes and assumptions that are inherent in the daily operation of an organisation and are reflected by the actions and behaviours of everyone within the organisation. In the field of security, culture is strong when everyone takes responsibility for keeping the system secure, no matter their level in the hierarchy or whether they are directly involved in security duties.

Security culture can be hard to pin down, but some specific actions can help aviation organisations make it stronger. A senior-level explicit commitment to security is essential: it can be embedded in the corporate Safety and Security Policy Statement, visible by all staff. Senior leaders must walk the talk and be role models for security, making sure they are not exempted from security measures which apply to the rest of the organisation. People should be trained upon starting their role and get security refreshers at regular intervals. Awareness of security threats can be promoted through campaigns, but it also be communicated daily through staff online social platforms or, simply, through posters on the walls. Finally, channels should be in place for staff to report suspicious behaviour or sightings, anonymously. Reports should be properly investigated, and feedback should be provided.

ACI World provides guidance to airports on how to strengthen their security culture in the Management of Security Handbook, published last year. We have also published an infographic which can be printed and circulated. ACI’s regions are also actively promoting the Year of Security Culture, organising webinars for their members and issuing practical guides on the topic.

How can an airport know if their security culture is strong? One airport sent out a survey to a large and diverse sample of staff, asking them to gauge their perception of security at the airport and to what degree they felt personally accountable for keeping the facilities secure. Surveys can be a useful tool to measure and track security culture over time, if they are carried out regularly. Other indicators include looking at the number of security breaches and performing frequent covert or over testing. Measuring the effectiveness of an organisation’s security culture is important, but it is not an exact science.

Security thinking

Security culture is often associated with awareness training, but it is more than a tick-box exercise. Among other things, a strong security culture is where everyone feels empowered to question and challenge assumptions. I believe this is a key issue to ensure buy-in and get people to feel involved in decisions. We need everyone to understand why measures are in place, what threats we face and how security constantly changes and adapts to new situations.

This means decision makers, including airport security directors and regulators, must be open to suggestions and to articulating the pros and cons of security mitigations. There is hardly ever a right or wrong answer to addressing a security risk. This means we need to get people to ‘think security’. This is not limited to abstract knowledge passed on through static training sessions, but is something which can be applied on a daily basis. For example:

• Understanding how risks are assessed and managed is key. Threats are many, but risks are based on likelihood and consequence, which gives us a framework for prioritising our actions.
• Taking good security decisions involves trade-offs between security and facilitation. For example, the decision was made in 2006 to restrict, and not to fully ban, the quantities of liquids that passengers can carry into the aircraft cabin.
• Risks are often mitigated but not fully eliminated. The part of residual risk that is present after security measures are introduced is something that people may or may not be comfortable with. This can be compared to your personal approach to financial risk. Whether people are risk averse or have a high tolerance to risk will depend on individual mindsets, but also on geopolitics, culture and timing (for instance, people tend to be very risk averse following a terrorist attack).
• A layered approach works best: no single technology, process or measure will identify, deter or prevent the range of threats that face civil aviation.
• Threats and risks change constantly, so we must review our tactics very regularly and keep them up-to-date. This means that as much as possible, the regulatory framework should be nimble and flexible (ACI promotes the concept of security regulations that are based on outcomes and not prescriptive).

Interestingly, the principles of ‘security thinking’ are largely applicable to health and can provide some useful pointers to navigate a way out of the uncoordinated measures we see today.

This makes security culture, and getting people to ‘think security’, more important now than it has ever been.