Improving civil aviation security: an endless task

As International Standards close more security loopholes, new ones emerge

By Morand Fachot

The recent crash of a Russian airliner has highlighted the difficulty of protecting civil aviation against deadly acts of violence. Russian officials have established that an explosive device caused the crash. Indications point to deliberate human interference rather than to ineffective technical security systems. The IEC develops many International Standards for technical systems and actions that enhance security for the air transport industry.

Electronic bag tag Electronic bag tags will be introduced over coming years (Photo: DS TAGS Group BV)

Vital industry relying on international standards and regulation

Safeguarding the air transport industry against a wide range of risks and threats is an all-inclusive enterprise aimed at protecting passengers, staff and critical assets both on the ground and in the air.

The technical side of this task can only be achieved if the multiple stakeholders involved adhere to sets of practices, regulations and international standards prepared by the industry, organizations and relevant authorities.

The civil aviation sector is of critical importance to most countries in terms of its economic, human and security aspects. According to data from the International Air Transport Association (IATA), the trade association of the world’s airlines, the total revenues of the industry reached USD 733 billion in 2014, as some 3 327 million passengers and 51,5 million tonnes of freight were transported by air that year.

The international standards and regulations necessary for ensuring safe, regular, efficient and economical air transport are set by the International Civil Aviation Organization (ICAO). ICAO is a UN specialized agency created by the Convention on International Civil Aviation (Chicago Convention) that was signed in December 1944.

ICAO works with the Convention’s member states and global aviation organizations to develop international Standards and Recommended Practices (SARPs), contained in 19 Annexes to the Chicago Convention, which ICAO member states reference when developing their legally-enforceable national civil aviation regulations.

Growing threats to safety over the years

Given the international nature of air transport, any act that has an adverse effect on its safety, be it aimed at aircraft or airports, results in the widespread disruption of flights worldwide and may even affect a country's economic prospects.

Aircraft hijacking, the unlawful seizure of an aircraft by armed individuals, emerged as a major threat in the late 1960s and early 1970s when dozens of aircraft were seized mainly for political reasons (terrorism, flight for political asylum) or criminal objectives (extortion). Sometimes deaths and the loss of aircraft were the outcomes.

A succession of attacks against US aircraft in 1972, including two violent hijackings and a bomb scare, led to an emergency Federal Aviation Administration (FAA) rule that introduced metal detection screening portals for passengers and X-ray inspection systems for carry-on baggage in US airports.

Similar measures, if not already in use, were soon widely adopted in other countries.

Managing risks with international regulations

Two ICAO Annexes contain SARPs directly relevant to air transport security.

  • Annex 9: Facilitation, first adopted in 1949, contains SARPs derived from several provisions of the Chicago Convention that, among other provisions, oblige each Contracting State to adopt all practicable measures to facilitate and expedite navigation by aircraft between the territories of Contracting States, and to prevent unnecessary delays to aircraft, crews, passengers and cargo. These SARPS also establish customs and immigration procedures affecting international air navigation in accordance with the practices established or recommended in the Convention.
  • Annex 17: Security: Safeguarding International Civil Aviation against Acts of Unlawful Interference, was adopted in March 1974 following a dramatic increase in violent acts which adversely affected the safety of civil aviation during the late 1960s / early 1970s. This annex sets out the basis for the ICAO security programme and seeks to safeguard civil aviation and its facilities against acts of unlawful interference. Experts from ICAO member states as well as from international organizations such as the Airports Council International (ACI), the International Air Transport Association (IATA), the International Federation of Airlines Pilots Association (IFALPA) and the International Criminal Police Organization (ICPO-INTERPOL) work to keep Annex 17 under constant review. ICAO also seeks to co-ordinate the activities of those involved in security programmes, such as states, airport and airline operators.

International standards matter

The implementation of ICAO SARPS on Facilitation and Security rests to a significant extent on technical solutions relying on special equipment and systems. These must meet international standards, many of which are developed by Technical Committees (TCs) and Subcommittees (SCs) of the IEC and by SCs of ISO/IEC JTC 1, a Joint Technical Committee on Information Technology set up by the IEC and the International Organization for Standardization (ISO).

Facilitating travel and access for airport staff

Facilitation implies traveller identification and border controls. The time when passengers could travel with passports in which details were often entered by hand or typewriter and photos were stapled to the document is long over.

Countries now issue machine readable travel documents (MRTDs), which are standardized in ICAO Document 9303: Machine Readable Travel Documents. These MRTDs enable faster processing of arriving passengers by immigration officials and are more reliable and more difficult to forge than the documents that preceded them.

ICAO 9303 was endorsed by ISO/IEC JTC 1/SC 17: Cards and personal identification, as ISO/IEC 7501, a three-part International Standard, which covers machine readable passports, machine readable visas and machine readable official travel documents.

Some MRTDs contain a chip; these eMRTDs can be read electronically and can contain biometric data.

IEC/ISO JTC 1/SC 37: Biometrics, develops standards for "generic biometric technologies pertaining to human beings to support interoperability and data interchange among applications and systems."

IEC/ISO JTC 1/SC 37 also developed ISO/IEC 24713-2, a specific international standard covering "biometric profiles for interoperability and data interchange" specific to "Physical access control for employees at airports". This standard covers the basic biometric functions of enrolment, verification and identification, and includes a database interface.

Controlling access to critical assets

What started the introduction of screening portals for passengers and X-ray inspection systems for carry-on baggage was the large number of violent acts against aircraft, crew and passengers by individuals bringing weapons into aircraft.

SARPs contained in ICAO Annex 17 are adopted by national and regional organizations and bodies such as the US Federal Aviation Administration (FAA) and the European Civil Aviation Conference (ECAC), which sometimes add more rigorous measures.

A tightening of measures such as the reunion of baggage with passengers, controls over items left behind on the aircraft by disembarking passengers, security controls for commercial courier services and controls over cargo and mail under certain situations have been added over the years to reduce the risk of sabotage.

Two identification technologies are important for the proper and safe tracking and despatch of hold baggage and freight and other uses. They are bar coding and RFID (radio frequency identification device).

Thermal paper bag tags are the main means of tracking hold luggage. Standard bar code tags may be misread when damaged or crumpled, forcing bags to be hand-sorted and increasing the likelihood of problems. Some airlines and airports have started using bag tags containing embedded RFID chips. Use of these tags can result in read rates in excess of 99%.

International Standards for bar coding and RFID are prepared by ISO/IEC JTC 1/SC 31: Automatic identification and data capture techniques. Standards for bar coding cover coding and also specifications for all equipment used to mark, identify or interpret the various types of barcodes, as well as the more recent QR (Quick Response) codes that are used increasingly frequently to produce electronic boarding passes sent by airlines to passengers’ mobile devices.

Going electronic

A number of airlines have started trialling so-called electronic tag bags that are particularly convenient for frequent travellers. They feature an integrated RFID chip and a custom built e-paper display showing an optimized barcode. These electronic tag bags can last several years, are not limited to a single airline and allow convenient remote baggage check-in and a much faster baggage drop-off process. With a combination of bar code and RFID they can already be used at any airport.

Future electronic tags will also rely on International Standards for e-paper prepared by WG 7: Electronic paper display, of IEC TC 110: Electronic display devices.

Improving scanning quality of baggage

The screening of passengers, carry-on and hold baggage depends on electrotechnical equipment. Although the IEC develops International Standards for medical imaging equipment using X-ray or computed tomography (CT) scan, it doesn't do so for this specific type of screening system.

However, experts from IEC SC 45B: Radiation protection instrumentation, are currently developing two International Standards relevant for baggage screening. One concerns the evaluation of the image quality of X-ray CT security-screening systems, the other focuses on bottle/can liquid X-ray inspection system – two areas of significant importance for air transport security.

IEC SC 45B has also developed a number of International Standards for radiation monitors for the detection of radioactive and special nuclear materials at national borders, and for personal radiation devices (PRD) for the detection of illicit trafficking of radioactive material.

Setting off alarms

As first and last lines of defence, critical installations rely on electronic security systems. This is the case for airports where these systems alert staff to potential risks of intrusion and block access to restricted areas by unauthorized individuals. IEC TC 79: Alarm and electronic security systems, prepares "International Standards for the protection of buildings, persons, areas and properties against fraudulent actions having the purpose to enter in a place or to take or to use something without permission and other threat related to persons".

Emerging threat

One area that is often neglected as technology advances is the risk of cyber-attacks on critical infrastructure. As such the air transport sector is seen as a potential target of such attacks, as some recent incidents show.

During the first half of 2015, at least five airlines, two airport operators and one civil aviation authority have been publicly reported as victims of online attacks, according to a recent IATA analysis.

Important International Standards in the field of IT security techniques are developed by ISO/IEC JTC 1/SC 27: IT security techniques, which prepared ISO/IEC 27001, Information technology – Security techniques – Information security management systems – Requirements. The second edition, published in 2013, "specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization".

Eliminating the weakest link

Guidelines and SARPs may be very strict, International Standards very detailed, security measures very rigorous and technical equipment very sophisticated, the human dimension will remain the weakest link in the whole security chain for the foreseeable future, and it needs to be addressed.

This has been clearly illustrated by the recent airliner crash as well as by some of the following examples from US airports: 1 400 badges, which allow airport workers access to secured areas, had been lost or stolen at Atlanta International Airport between 2012 and 2014, and dozens of loaded weapons are found every day in passengers carry-ons.

Ensuring this will no longer be the case in the long term is the next major challenge for the industry.

Luggage scan Security scan of luggage showing content (Photo: Smiths Detection)
 Rapiscan Rapiscan scanner used to scan hold baggage (Photo: Rapiscan)
Electronic bag tag Electronic bag tags will be introduced over coming years (Photo: DS TAGS Group BV)