The Digital Aviation Industry: A Balancing Act Between Cybersecurity and European Consumer Protection

Abstract

The connectivity of computers is essential in aviation as systems must simultaneously and constantly speak with one another. For example, computers enable passengers to book tickets, check-in online and clear airport security. Furthermore, air carriers rely on them in order to operate their aircraft, such as, through varying communications links with ground handlers, air traffic controllers, other air users and the relevant airports. As the use of computers and their connectivity increases in aviation, cybersecurity will continue to grow in importance, as it will be vital for providing safe and secure transportation. There is, however, a tendency to treat ‘cybersecurity’ as one homogenized topic, rather than as an overarching title that encompasses numerous acts, different attackers, varying victims and a plethora of consequences. If this complexity is not appreciated, there could then be the tendency to sensationalize the topic to a point where a cyber-attack is generally perceived as an extreme, unpredictable and unpreventable event. This article will analyse the consequences of a cyber-attack within the currently unexplored context of consumer protection. In particular, emphasis will be placed on the scrutiny of the European ad hoc regime in terms of air passengers’ protection, namely Regulation 261/2004. This article will specifically focus on whether a cyber-attack can amount to, and if so, to what extent, an ‘extraordinary circumstance’ in which the air carrier can invoke to exonerate itself from paying compensation as prescribed by the Regulation. Therefore, this article will attempt to highlight the recently established links between passenger rights and cybersecurity, expose the complex and relatively unexplored topic of aviation cybersecurity, and show some key considerations that must be appreciated when looking at the extraordinary circumstance defence following a cyber-attack.