1. Aviation Security

Aviation security is the protection of civil aviation against acts of unlawful interference. This objective is achieved through a combination of measures and resources both human and material, aimed for the safety of passengers, crew, ground personnel, and the general public.

2. AVSEC Planning:

The Aviation Security Planning incorporates the key aspects and themes. The need for effective, risk-based measures that are assessed regularly to reflect the evolving threat picture, ensuring that measures are effectively implemented on the ground on a sustainable basis, resource allocation and the promotion of a culture of security; and establishing effective national oversight of aviation security systems.

Aviation Security being an international issue therefore   States are dependent on the effectiveness of each other’s aviation security systems to provide a common secure aviation environment. Despite enhancements to the security system, terrorists continue to view civil aviation as an attractive target and continue to exploit real or perceived vulnerabilities in the international civil aviation system, with the aim of causing substantial loss of life, economic damage and disruption to connectivity and trade between States.

Without question, enhancing aviation security will bring financial and other economic benefits. The economic and financial cost to States, airports, airlines, and stakeholders of terror attacks and security breaches can be very significant, and the loss of human lives cannot be measured. On the financial and economic side, some recent attacks have caused huge financial losses as a result of close to two weeks suspension of airport and airline operations, repair to infrastructure, and other losses suffered from terror attacks.  Other repercussions may also be suffered as a result of poor aviation security standards and measures, including the loss of public and investor confidence, and effects on tourism, trade and connectivity.

The objective of establishing the Aviation Security Planning is to help stakeholders enhance the effectiveness of aviation security. The AVSEC Planning, therefore, seeks to unite the international aviation security community and inspire action in this direction, considering that the threats and risks faced by civil aviation the community continues to evolve. It is also intended to achieve the shared and a common goal of enhancing aviation security worldwide and to help States come together to fulfill the commitments set out by the ICAO. To achieve the objective of AVSEC Planning the following principles are necessary to be followed:

(i)           Effective implementation and compliance: Appropriate measures that are applied to ensure consistent outcomes, coupled with a robust security quality control and oversight system.

(ii)         Sustainability: Utilizing measures that are proportionate and realistic in the long term, duly coordinated with entities from other sectors (e.g. aviation safety, air navigation, facilitation).

(iii)       Cooperation and information sharing. Strengthen cooperation and sharing of information between and amongst States and stakeholders. To ensure that the principles of cooperation defined in bilateral and/or multilateral air services agreements, recognition of equivalent security measures, and focus on security outcomes continue to be the basis for international cooperation.

(iv)        Security culture and human capacity development. Establish a strong and robust security culture and develop human capital, skill and competency.

(v)           Innovation. Encourage stakeholders to devise, establish and share new and innovative ways to implement security policies and measures.

(vi)        Identifying, understanding, and managing risk. Enhance understanding of aviation security risks, and take appropriate and effective action.

Continued improvement ineffective implementation of Annex 17 is paramount to assure the security and regularity of air transport. The AVSEC Planning applies to each country and its stakeholders to guide effective implementation and compliance efforts, promote accountability for these security responsibilities, and enhance the effectiveness of global aviation security. 

3. AVSEC Security culture

AVSEC planning is focused on Developing Security Culture and Human Capability. Security culture is a set of norms, beliefs, values, attitudes and assumptions that are inherent to the daily operation of an organization and are reflected by the actions and behaviours of all entities and personnel within the organization. In relating to aviation security, building a strong security culture will capitalize on shared resources, promote information sharing, ensure recognition that effective security is critical to business success, establish positive security practices among employees as a core value, and align security to core business goals.

An effective security culture can result in employees who are engaged with, and take responsibility for, security issues. It is an essential component for a protective security regime, which supports and maintains a risk-resilient organization. Promoting a positive security culture helps to mitigate against both insider threats and external threats as personnel think and act in more security-conscious ways and can identify and report behaviours or activities of concern. In turn, this results in all personnel feeling that they have a critical role to play within a security regime, and security overall being improved - for not just aviation security but for wider border security without the need for significant investment. From screeners to cleaners, and from taxi drivers to those working in airport retail outlets, all have a vital contribution to make to improve aviation security.

A robust and efficient security regime must be proactive and supported by competent people. Furthermore, a security culture can only be successful if people are accountable and motivated to follow established procedures, comply with prescribed regulation and take the initiative when unforeseen circumstances arise. An effective Security Management System (SeMS) can offer one way to achieve this by providing an organized, systematic approach to managing security which embeds security management and risk ownership into the day-to-day activities of the organization and its people.

All stakeholders should be encouraged to ensure capacity and capabilities are built up throughout the system by investing in human capital for a motivated and competent workforce. This will help to achieve a security culture where everyone knows their role and responsibilities within a security regime. Such actions could include those highlighted in the Security Culture Toolkit¸ which includes, but is not limited to, initial and recurrent training on security culture and continuous learning activities; promotion of security culture by senior leadership, a targeted communication plan and continuous security awareness campaigns; and the establishment of a reporting system that guarantees the confidentiality of reporting individuals.

It is emphasized that a transformation in security culture behaviour and awareness can be challenging to deliver and to embed throughout an organization from the top down. To receive the most benefit, all stakeholders and entities should take a multi-agency approach so that support for security culture is not just focused on aviation security but security as a whole.  Organizations and industries need be encouraged to take immediate practical steps to begin delivering high profile behaviour change campaigns and other practical actions to promote a strong and sustainable security culture within their organizations.

The aviation security culture can be well achieved throughout the aviation facilities through regular AVSEC Training and Quality Control oversight besides general security awareness to all stakeholders and users of airport facilities.

4. AVSEC Training

Every effort to strengthen AVSEC, whether through the development of practical policies and procedures, advanced technology, and the implementation of effective measures, depends on human factors. To develop sound AVSEC policies and practical measures, personnel who are charged with these responsibilities will need to have a good level of AVSEC knowledge and appreciation of AVSEC challenges, in order to develop effective approaches and solutions.

CAO clearly acknowledges the importance of AVSEC training. Under the Convention on International Civil Aviation, there are several SARPs that place emphasis on the importance of AVSEC training.  ICAO’s Global Aviation Security Plan (GASeP) which was promulgated in November 2017 also places emphasis on AVSEC training. Under the GASeP’s priority outcome to develop security culture and human capability, it emphasizes that “The existence of a well-trained, motivated and professional workforce is a critical pre-requisite for effective aviation security”. The GASeP also has at least five priority actions and 10 priority tasks on improving AVSEC training.

With greater synergies needed between regulators and industry, AVSEC training programs to help regulators, industry and operators to understand the common challenges and develop collective approaches to deal with new and emerging AVSEC challenges are also necessary. Further collaboration on AVSEC training between regulators, industry, operators and ICAO are strongly encouraged. These can include joint seminars, courses and conferences, where sharing of best practices and new AVSEC training needs and initiatives, including dealing with evolving challenges such as cybersecurity threats, landside security and dealing with the insider threats, will be useful and help generate cross regulator-industry appreciation and learning.

Another critical area of AVSEC training is focused on providing top management personnel from regulators and industry with a strategic appreciation of AVSEC challenges and needs. This would be useful to help top management personnel to understand and appreciate the importance of AVSEC and how AVSEC needs and requirements can be better facilitated within the civil aviation ecosystem. It would also help top management personnel to better understand and forge stronger inter-agency and cross-organization collaboration between Governments, industry, and operators, on AVSEC risks, regulations and effective implementation of measures.

In this regard, India strongly advocates the importance of AVSEC training. The Indian Aviation Academy1 (IAA) continues to develop and offer various AVSEC training programmes, including courses in collaboration with industry bodies.

 

5. Quality Control Oversight

A fundamental component of an aviation security system is the effective implementation of quality control measures. In the aviation security context, quality control measures can be defined as the surveillance techniques and activities used to assess the aviation security system of the concerned country and, where required, to resolve identified deficiencies. To implement quality control measures, Appropriate Authority of Civil Aviation Security of each member State must develop, implement and maintain a National Civil Aviation Security Quality Control Programme (NCASQCP).

Annex 17 of the International Civil Aviation Organization (ICAO), is the primary source of Standards and Recommended Practices (SARPs) for the establishment and management of a State’s National Civil Aviation system, by addressing preventive and responsive security measures. The fundamental challenge for the establishment and management of such a civil aviation security system is to create an aviation security regime that is highly effective in preventing acts of unlawful interference and ensures compliance with specific regulations but does not unduly interfere with the efficiency of civil aviation, impose excessive costs or intrude unnecessarily into private rights or civil liberties.  The Quality control oversight is responsible to:

• Determine Compliance with and validate the effectiveness of the State’s rules and regulations relating to aviation security operations including the National Civil Aviation Security Program (NCASP).
• Identify all aspects of security measures that might call for changes in aviation security regulations/NCASP or means of implementation.
• Verify the effective implementation of security measures.
• Monitor implementation of aviation security measures by airports, aircraft operators (national and foreign aircraft operators), Regulated Agents, Cargo Handlers, known consigners, catering companies and other entities that perform security functions, in compliance with regulations and the national civil aviation security program (NCASP).
• Determine the adequacy of effectiveness of the National Civil Aviation Security Programme and regulations.
• Ensure all persons who are assigned AVSEC duties or responsibilities are subject to background checks, selection procedures and are verifiably trained and instructed/certified to carry out such duties.
• Review and re-evaluate security measures and controls immediately following an act or simulated exercises of unlawful interference.
• Gathering of information on aviation security from sources outside the quality control system, such as reports on a voluntary basis from passengers, crew members and staff employed by airport and aircraft operators.

In order to achieve the primary objective i.e. protection and safety of passengers, crew, ground personnel, general public, aircraft and facilities of an airport serving aviation against acts of unlawful interference perpetrated on the ground or in flight, various combination of measures and marshalling of various human and material resources are implemented at the appropriate level through various programs. Standardized implementation of these AVSEC programs is to be ensured in India.

It should be ensured by the appropriate authority that:

• The persons implementing security control possess all competencies required to perform their duties and are appropriately trained according to the requirements of the National Civil Aviation Security program and the appropriate records are maintained up to date. Relevant standards of performance need to be established and initial and periodic assessments needs to be introduced to maintain those standards.
• The personnel carrying out security audits, tests, surveys and inspections are trained to appropriate standards for these tasks in accordance with the National Civil Aviation Security program.
• The persons implementing security controls are subject to background checks and selections procedures.

    6. AVSEC Challenges: 

Terrorist groups are actively seeking ways to defeat or circumvent aviation security. All states have a responsibility to protect the security of citizens and nationals of all nations against terrorist attacks on air services operating within their territory. 

The global aviation industry is heavily relied upon by many and the demand for air travel will only grow. In fact, experts predict it will double over the next 20 years. That’s why security has and will always remain a top priority for those in aviation. So the types of challenges related to security the industry face today are noted below:

• Insider Threats

An insider threat is defined as the threat that an employee or a contractor will use his or her authorized access, wittingly or unwittingly, to do harm to the security of civil aviation throughout the world. Insider threats have long existed in the airline industry, such as when a Horizon Air employee commandeered a turboprop passenger plane from Seattle-Tacoma International Airport in August 2018, or an American Airlines mechanic tampered with an aircraft's air data module (ADM) system in 2019. Aviation leaders need to take a holistic approach by creating an insider threat program across the aviation industry.  Increasingly, insider threat cases and high-profile data leaks illustrate the need for strong insider threat programs within organizations. The number of infamous and damaging attacks against the government illustrates that the threat posed by trusted insiders is significant.

 

This threat will continue to grow as increased information-sharing results in greater access to and distribution of sensitive information. The effort should be developing novel methods to detect insider threats through disk-level storage behaviour and how an individual’s behaviour diverges from prior behaviour and/or that of their organizational peers. Current approaches rely on rules/signatures and look for patterns matching previous attacks. Analysing disk-level storage behaviour with a lightweight media forensics agent will provide a more in-depth look at user behaviour for indicators and proactively identify potential threats.

• Cyber threat

Cyber threats are a major concern for all companies and organizations worldwide, or at least they should be. Losing control of the most valuable assets – your data – could have potentially devastating ramifications – which is exactly why cyberattacks are becoming more and more common. Several of the major cyber threat incidents recently have been traced back to national agencies. Depending on the type of attack, such threats may be defined as either cyber-attacks or cyber terrorism.

Cybersecurity is the protection of the privacy, integrity, and accessibility of devices, networks, systems, and data information. Cybersecurity is about protecting your data services from a potential cyber threat and being able to recover if an attack should occur. Building a solid cybersecurity system is difficult – and protecting Aviation operations from all external threats is borderline impossible.

To succeed we need to have good routines on how to handle threats and breaches, foster a culture of security, test our applications, and perform exercises to increase knowledge of potential threats and security risks.

Civil aviation is mainly reliant on cyber-enabled technology which is used to increase the safety and efficiency of air transport.  However, the interconnectivity of systems and dependency on technology created the optimum premises for new risks to emerge.

• Security Screening

Another ongoing challenge is security screening. This may include checkpoints for staff and contract workers. Most travellers are familiar with passenger checkpoint screening and cabin baggage screening because they experience it first hand at the airport. It also includes hold baggage screening as well as air cargo screening for shipments on passenger and cargo aircraft. Each of these checkpoints is unique with the volume of people and items flowing through, screening methodologies used, standard procedures to follow, and types of threats or prohibited items to look for.

•  Operations

Day-to-day operations are another challenge for the aviation industry. Not only does each organization have to worry about the effectiveness and efficiency of their own performance, but they also have to be concerned about compliance with government regulations. In order for operations to be successful, cooperation between airlines, airport operators, regulators, and equipment manufacturers must be well-managed.

7. Measures to counter the challenges:

With so many areas to proactively manage and control, how can security teams manage it all? The sheer volume of what goes on in an airport requires nothing short of a robust set of supervisory tools and powerful oversight designed to see it all at a glance with relevant alerts built-in at appropriate places. It must also track and report to ensure compliance at every step of a shift. Maintaining security standards and mitigating challenges can be achieved by:

Creating a comprehensive view of the airport’s security status and potential risks:

 This is best achieved by moving the airport security officers into a fully digitalized workforce management environment. With a cloud-based solution that delivers real-time data, managers and supervisors can see their entire airport security status on a single screen, allowing them to identify potential security or customer conflicts before they become a serious issue. Security teams move from being reactive to proactive.

Anticipating adjustments in staffing requirements:

Supervisors can proactively manage sudden changes in passenger flow or needs, as well. Long waits for just the right additional personnel are cut down when a supervisor can see, at a glance, who is on the clock and available to assist with coverage. With this approach, travellers needing extra assistance or enhanced screening can be assured that personnel are ready to do the job.

Improving field monitoring and reporting operations:

 Security supervisors need more than an assurance that their security officers are in the proper place at the proper time. From passenger screening to luggage checks to utilization of de-escalation techniques, supervisors need the unfettered ability to inspect officers in the field to ensure they are doing tasks by the book. Reporting the findings and reviewing them regularly should be a key part of improving the overall quality of your security operations.

Locating and dispatching officers in real-time:

 Airports cover large surface areas and security officers will likely be patrolling and performing duties in a myriad of locations. Supervisors can reduce risks and the margin for error by having the ability to locate their officers in real-time via GPS technology so they can instantly see where their officers are at any time and ensure they are at their stations performing their duties. This capability allows them to immediately dispatch the nearest officer, based on proximity, to investigate an alarm, support another officer, or respond to a member of the public. Geolocation capabilities mitigate risks by enhancing officer accountability and the delivery of efficient security services. 

8. The utmost endeavours to achieve better security:

Efforts should be directed towards making airport security systems smarter and more flexible, not necessarily more encompassing, or extensive. Intelligence on threats and adversaries can be the basis for configuring a flexible system to meet those threats and to focus enhanced security measures mainly on high-risk individuals. To this end, channels of information and coordination must be established between the airport security systems and the intelligence-gathering and -analysis activities of national and local law enforcement agencies.

Another source of intelligence is the computer-Assisted Passenger Pre-screening System (CAPPS). When a ticket is purchased, CAPPS can rate passenger risk on the basis of about 40 characteristics, including address, credit history, destination, travel companions, type of payment, and type of trip. Special technology, such as electronic strip searches, that are too time-consuming to be used with all passengers could be employed to screen those identified as high risk. Other procedures not involving technology, such as personal interrogation and assessment, could also be employed with the few passengers identified as high risk.