The Threat of Insider Threats

 Security threats are an ever-evolving concern in just about every industry you can think of, including aviation. Security individuals and the organizations they work for find themselves in an almost cat-and-mouse type game with perpetrators trying to exploit shortcomings to cause mischief, confusion, chaos, destruction, and even death. IATA  has identified several key and persistent threats, one of these security issues is known as an 'insider threat'. "Insider threats can take a wide variety of forms. They can be the sharing of sensitive procedures, attacks on information systems, smuggling goods or people into security restricted areas. If there is a way to cause damage or extract personal or financial gain, there is a vulnerability to an insider threat."(IATA, 2022)  Those who stealthily try to utilize a trusted position that they have gained from inside an organization, would be classified as an insider threat. similar to being a civil servant like a police officer, those in the aviation industry are generally trusted to perform duties or trusted with access to sensitive sites/information in order to support the organization and ensure safety and other regulations are maintained. 

One example of an insider threat brings us to Miami International Airport where an aircraft mechanic utilized "his access to the backside of the Miami airport terminal to drive up to a Boeing 737, open a compartment below the cockpit, and glue a piece of foam inside navigation equipment in such a way that pilots wouldn't be able to tell how fast or how high they were flying."(David Koenig, 2019) To work in secure areas of an airport, federal law requires an employee (or potential) employee to successfully complete a three-part process. This aims to preclude any potential employees from being granted access to sensitive areas of an airport. This process consists of "a criminal-records check, a 'security threat assessment' that includes checking their names against a terrorism watch list, and proof that they are eligible to work in the United States." (David Keonig, 2019)  If upon completion of this process, you are granted sensitive area access, you would be issued an ID that generally grants you access to the specified areas that pertain directly to the performance of your job. These are two examples of layered security as it applies to the deterrence of insider threat attacks. In recent years TSA (the organization responsible for vetting employees) has been granted increasing power to aid in their search for any questionable records of potential employees. ID checkpoints also offer another layer of security, preventing employees from gaining access to areas that are not authorized to be in (for a plethora of reasons) and limiting them to their work areas. Security cameras also add a layer, while passive they can aid in identifying a suspect allowing them to be discovered and brought to justice. In the case of aircraft mechanic Abdul Alani, he was identified by coworkers through the use of security cameras. It is also worth mentioning, in the cases of insider threats to knowingly damage or impair an aircraft, the modern technology of aircraft can also be a layer in some cases. No one was injured and no damage to the aircraft occurred because upon powering up after taxing, the onboard computers recognized a fault within the Air Data Module system (ADM) with the diagnosis being to abort the flight before even attempting takeoff. That technology was the sole reason the event did not end in tragedy. 

I think the pre-requisite vetting process can be slightly more in-depth and thorough. Time, effort, and manpower would have to be dedicated to ensure that TSA's system can catch those with disqualifying records. And those individuals are identified and won't be able to slip through the cracks. I also believe that creating more infrastructure would help, being able to physically block off certain areas as needed can prevent those with unauthorized access from running around doing whatever they like. Also periodic investigations for security purposes, just to ensure that no new information is present. Otherwise I think the existing strategies work well, there are very few other instances of an attack similar to Mr. Alani.

References

IATA. (2022, August 23). What you need to know about aviation security? Www.iata.org. https://www.iata.org/en/publications/newsletters/iata-knowledge-hub/what-you-need-to-know-about-aviation-security/

Charge against airline mechanic highlights “insider threat.” (2019, September 21). AP NEWS. Retrieved April 17, 2023, from https://apnews.com/article/travel-us-news-ap-top-news-arrests-airlines-ce13931c2dae4bd482d9ace2ce28db92