There’s another broad based security problem sneaking up on airports that could put you in a proverbial pickle ... cyber-security.  You’ve seen it in the news lately in a larger context – shut-down of the east coast pipeline and at the country’s largest meat-packing plant, and in dozens of schools, hospitals and city governments – particularly using ransomware to lock up all their data and operations until they are paid a significant bunch of money.  Now, let’s change just one word in that description – change “their” data and operations to “your” data and operations.  Will you survive it?  What’s your worst case scenario?  Double it.

The current thinking is that any major cyber attack effort would likely target the FAA and Air Traffic Control.  Even in these truncated still-pandemic times, there are an estimated 5,670  passenger flights in the US airspace every day, plus charter, cargo, GA, military, training and more...  Amazon alone has 77 freighters, with 9 more on order.  Short-staffed TSA screened over 2 million people in one recent day. Now, imagine  all those planes and people already in the system, and a similar batch of folks on the way to the airport to take their place outbound, when the entire system goes dark.  Yes, we know most of it is electronically isolated to a great degree and facilities have emergency power back-ups, and we know there are ATC plans for brown-outs and black-outs.... all mostly for short term service breaks until the power comes back on. 

What if it doesn’t? For how long?   What are your airport’s CYA plans when airplanes  can’t land or take off into an unstable ATC system; when they can’t fuel up when the pipeline runs dry; when your access control system fails “open” at all the fire doors, the concessions run out of food and beer for people sleeping on the floor,  the internet jams up, along with the communications links, and more.  Unlikely? ... at least all at once? Probably.  But there are none among us who can provide the assurance that some of those things (which ones didn’t I list?)  may very well happen when you least expect it.  It may look a bit like your tornado/hurricane plan, but with a lot more variables not within your control.

Some airports are already adding cyber insurance to their business operations , accepting the notion that these events have only just begun, and could be targeted locally, especially at large/hub airports which would cause the most disruption for the least effort... think JFK, ORD, ATL, DEN, SEA, including airline hubs.  Your IT system probably has a data backup and recovery plan, but they typically assume that the underlying infrastructure itself remains sufficiently viable.

I really don’t want to be an alarmist, but we’ve all seen the enormous impact of just what is possible by cyber-attackers, both foreign and domestic.  Those little pranksters have just hinted at the unforeseeable and immense downstream effects they are planning  at your airport.