Cyber Threats to Aviation, Space and Need for Resilience

Legal aspects of Aviation Security
There are nine Agreements/ Treaties/ Conventions in force today which can relate to crime in aviation. However, none of the above relate to Cyber crime, ICAO (International Civil Aviation Organisation) Secretariat Study Group on Cyber- security (SSGC) was established in August 2017. In addition there exists a United Nations Security Council Counter-Terrorism Committee (CTC) established after the 9/11 attack. Not much has come of it.
The Tallinn Manual is a compilation by an independent group of international cyber experts invited by NATO in 2009 to produce a Manual on the law governing cyber warfare. According to the authors of the Manual “The focus of the original Manual was on the most severe cyber operations, those that violate the prohibition of the use of force in international relations, entitle states to exercise the right of self-defence, and/or occur during armed conflict”.
In summary, neither the UN nor ICAO have really moved towards a security setup to counter the new force of Cyber Warfare which can be destructive and humiliating.
Aviation as a medium is, perhaps, the most technology driven service. Over time aircrafts have become more efficient, faster, economical and bigger in size. Use of electronic and computers have found have found their way into all aspects of aviation and hence the cyber vulnerability also increased. Aviation and Space technology were at the forefront of mobile computers, automation and remote control.
However, as pointed out in the research paper 'The types of hackers and cyber-attacks in the aviation industry' in the Journal of Transportation Security published on 28th August, 2024.
However, under new Data Protection Regulations (DDPR) law for UK & USA companies and individuals are required to report a cyber-attack and can be fined for not reporting. Consequently, in 2019 British Airways paid a fine of $230 million for not reporting a data breach in 2018, the largest penalty against a company. But all countries for not have this rule.
International Air Transport Association (IATA 2023) reported that cyber-attacks are increasing in the aviation industry, and airport. According to Airports Council International ( ACI) , the global association of Airports, 62% of Airport Authorities were subject of cyber- attacks (ACI 2021) and in 2020 European Aviation Safety Agency(EASA) reported an average of 1000 airport cyber-attacks( EASA 2021). The cost of one cyber-attack was estimated at to be $ 1 million. In 2023 it was estimated that global aviation cyber security market had costed $4.6 billion and expected to reach $8 billion by 3032. There are different types of cyber-attacks and one needs to identify them.
The economic impact of cybercrime on business is predicted to reach $10.5 trillion by 2025. The air transport industry faces increased cyber threats and cyber-attacks due to hyper connectivity and the lack of standardised frameworks and cyber security defences (Nobles 2019). The dark web and even some video guide tutorials on the internet provide hacking tools without any restrictions. If we add to this, some of the cyber-attacks mutates its signatures and codes to evade detection (called polymorphic)

India
In India - One of the earliest cyber-attack was known as The Sita Attack on Air India in 2021 when their Passenger Service System, SITA, was hacked and personal data of 4.5 million Air India's passengers compromised and stolen. This was followed by by many more, as a result cybercrime in the aviation industry in India has become a growing concern due to the increasing number of cyber-attacks on major airports and airlines. Hoax calls, as experienced in India recently in 2024 with over 300 calls without any trace, is yet another method of cybercrime. However, since there is no ransome involved but damages airlines reputation and finances , there is so far no motive attached to the recent 300 plus hoax calls.
Cyber Attack on Air Traffic Management : The most dangerous aspect of Cyber attack in Aviation is in the cockpit when cyber attack can disable or derail the Air Navigation Service or on Air Traffic Control.
According to Kate O'Flaherty, “The possibility of an aircraft being hacked has been demonstrated, but it has not taken place in reality – yet. In 2019, cyber security firm Rapid7 showed how an attacker could disrupt electronic messages transmitted across a small plane's network. The researchers demonstrated how attaching a smalldevice could impact aircraft systems, allowing false measurements to be sent to the pilot, including engine readings, compass data and altitude”.
An important aspect to note is that cyber security is a recent threat and the aircraft under current use were not planned with this security in mind. Even Federal Aviation Administration Authority of the US has warned all pilots using US airspace not to depend fully upon GPS as GPS can be hacked and mislead the pilot.
Therefore, for the above mentioned reasons i.e. in face of evolving cyber threats, the air transportation industry needs a robust cyber-security framework holistically for all its participants- airlines, airports, air traffic control, ground handlers etc. This can be best coordinated by a National Aviation Security i.e. the existing Bureau of Civil Aviation Security (BCAS) in India and the government ministries like Aviation, Space and Interior or Home. At international level ICAO should work on Standards and Guidelines on it.
The four organisations working on aviation cyber issues are: ICAO Cyber- Security Framework ; NIST National Institute of Standards and Technology; FAA Aviation Cyber Security Plan; EUROCAE ED-203 Standard.
Indian laws against Cyber Crime in Aviation consist of:
1. The Information Technology (IT) Act, 2000, is the primary legislation dealing with cyber- security, data protection and cybercrime. Identifying activities such as hacking, denial- of-service attacks, phishing, malware attacks, identity fraud and electronic theft as punishable offences.
2. Suppression of Unlawful Acts against Safety of Civil Aviation Act ,1982 which states at Chapter 2 Art 3(C) which carries punishment with Life Imprisonment and fine in bomb placement or even hoax bomb calls.

Aero-Space and Cyber Threat:
Cyber threat in Space exits as much as on ground or air. Space assets need protection from cyber threats. Space assets as very much in use in everyday life on earth as well as in aviation. The GNSS ( Global Navigational Satellite System) of which GPS of US, GLONASS of Russia, EGNOS of EU and Beidou of China are the four constellations providing the same service in navigation and remain highly vulnerable. GPS remains the most popular to provide navigation to aircrafts in air amongst its many other uses.
However, these systems are subject to jamming and spoofing and therefore, not fully reliable. FAA has already instructed pilots flying over US airspace not to depend entirely on GPS. While Jamming a signal is simple, Spoofing is a cyber-attack sending a fake radio signal to a radio receiver antenna to override a legitimate GPS signal diverting the direction of a moving entity.
Today, aviation, space and cyber domains are integral and interdependent. Another aspect of space is the blurring of distinction between civil and military as a large part of the satellite can be put to dual use. The most glaring example of it is during the current ongoing Ukraine-Russia war. 'Starlink' of Elon Musk immediately responded to jamming of Ukrainian signals by setting up over a hundred ground stations without delay restored the satellite based telecommunications including that of their military. Similarly, It was reported in newspaper on 9th November 2024 that North Korea caused GPS disruptions for South Korean airplanes and boats. Air Traffic Control (ATC), search and rescue operations, the electric grid and mobile phone services are all vulnerable to GPS jamming. Proper Spectrum monitoring, enables GPS jammers to be detected and located by mobile direction finding systems. Analysis of frequency spectra to determine duration of interference and signal type can also be used as an indication of whether the interference is accidental or deliberate. This results in quick resolution of disruption and danger caused by GPS jamming and acts as a preventative deterrent. Law enforcement agencies or any organisation highly dependent on GPS services, like Air Traffic Control, should also operate a dedicated counter-jamming system to ensure continuous protection of critical infrastructure. In April 2024 tens of thousands of planes flying in a war torn region have reported problems with their navigation systems amid widespread jamming attacks, which can make GPS inoperable.

GPS spoofing in its simplest form involves location information being sent to the GPS receiver which is clearly false.The identification of perpetrators and their locations are generally considered as a great obstacle to attribute unauthorised cyber activities to States. Nevertheless, some malicious cyber activities that require the coordination and involvement of a large group of persons give hints on the complicity of governments. Studies have shown that it is possible to allocate the origin of large-scale malicious cyber-attacks to States.

The Remedial Action
To prevent GPS spoofing attacks, industries that rely on GPS signals for timing and synchronisation must take steps to secure their systems. This can include using encryption to protect GPS signals, deploying anti-spoofing technologies, and using multiple sources of timing information to ensure redundancy. With cryptography, organisations encrypt the satellite codes coming and going. Only those with access to these codes can read the coordinates.
An unprotected GNSS receiver is vulnerable to even the simplest forms of spoofing like a house with open door. Secured receivers, on the other hand, can detect spoofing by looking for signal anomalies, or by using signals designed to prevent spoofing. such as Galileo OS-NMA and E6 or the GPS military code.
Galileo is the first satellite system about to introduce an anti-spoofing service directly on a civil GNSS signal with OS-NMA (Open Service Navigation Message Authentication). OS-NMA is a free service on the Galileo E1 frequency. It enables authentication of the navigation data on Galileo (and even GPS satellites). Such navigation data carries information about satellite location and if altered will result in wrong receiver positioning computation. While currently in development, OS- NMA is planned to become publicly available in the near future. Also GPS is also experimenting with satellite based anti-spoofing for civil users with their recent Chimera authentication system.

Need for Cyber-resilience
We define cyber resilience as the ability to predict, detect, respond, and recover from cyber threats. In the context of the aviation industry, cyber resilient airlines should display attributes of complete preparedness and adaptability to address cyber threats and recover from a cyber-attack proactively.
Defending against cyberthreats is a critical and ongoing process that requires a proactive and multifaceted approach. Social engineering, third-party exposure, cloud vulnerabilities, ransomware, and IoT are the top threats that organisations should focus on to protect their data, systems, and reputations. As such, organisations should invest in security awareness programs, third-party management, cloud security, backup and recovery, and IoT security to help prevent and mitigate
Last but not the least is the need to stop the increased adoption of commercial off- the-shelf (COTS) software in the aviation and even space industry that is not customized for use and does not exhibit the level of cyber resilience required for airline and satellite businesses.