Aviation as a critical infrastructure: challenges and opportunities for a more resilient sector

Aviation is a complex interconnected "system of systems" consisting of infrastructures or systems such as ATM, ground services, telecommunications, etc. All these systems and infrastructures are interconnected and interdependent with different levels of criticality, threats, vulnerabilities and risks. Aviation depends on other infrastructures and systems such as energy, transport and telecommunications, and other infrastructures and sectors depend on aviation to provide services to citizens.

Critical infrastructures and entities providing essential services have always been on the EU’s radar. The EU has made several efforts in the past with the ECI (2008/114/EC) Directive, NIS (EU 2016/1148) Directive and other sectoral measures to address a wide range of threats (including cyber) that could potentially affect critical infrastructures including, of course, aviation. In recent years, collective thinking on critical infrastructures and their protection has evolved, and the EU is taking additional measures to support Member States and operators to improve their security postures and the resilience of critical infrastructures, and protect the services they provide against all possible threats, including man made, natural hazards, cyber-attacks and terrorism. The CER (Critical Entities Directive) and NIS2 constitute the culmination of these efforts and both provide the necessary framework and measures in order to improve the security and resilience of such infrastructures and essential services to EU citizens and beyond. Aviation is considered in the CER directive as a transport subsector and more specifically air carriers, airport management bodies and operators providing air traffic control.

The aviation sector is highly optimised – hence the need for improving its resilience will always be high on the agenda. Increasing the resilience of the aviation sector to address disruptions and shocks and at the same time maintain its highly optimised performance and affordable prices is certainly a very difficult equation.

In addition to the acute shocks and disruptive events, the aviation sector will have to adapt to structural changes and megatrends that will affect all aspects of its operation. The twin green and digital transition is certainly one of the most important challenges, and it will affect the aviation sector in unprecedented ways. The European Green Deal launched by the European Commission aims at creating the world’s first climate-neutral bloc by 2050. It is no surprise that greening of the aviation sector is in the spotlight. Given that the amount of air traffic is expected to increase in future, reducing emissions from the aviation sector will rely on investments in innovative technology areas such as materials, more efficient engines and alternative fuels, to name a few, but also on more immediate actions such as the improvement and optimisation of ATC.

In addition to these, climate change is expected to increase the number of extreme weather events, with obvious consequences. For example, extreme heat and high-density altitude can lead to delays in scheduled flights and payload reduction. Flight cancellations due to extreme events can become more frequent. Investments will be needed to upgrade aviation infrastructures such as airports, terminals, ATC and routes to cope with these challenges.

The rapid digitalisation that is currently taking place in all sectors obviously touches aviation too. The positive aspect is that digitalisation can contribute to further optimisation of aviation, in particular in ATC. This, however, comes at the cost of new vulnerabilities in the digital domain across the whole value chain of the aviation sector. Addressing these vulnerabilities requires action in many areas from increased IT and OT security to training, education and raising awareness of involved personnel. The level of awareness of cyber risks is increasing in all industries and critical infrastructures, and to this end best practices from other sectors (for example in the energy sector) can be leveraged by the aviation sector to increase the level of security and cyber resilience.

In addition, aspects related to personnel vetting, insider threats and foreign interference need to be thoroughly checked by authorities and operators. In other areas and domains, the debate about cyber certification as a means to improve resilience and security of critical infrastructures is currently high on the agenda. There are arguments both in favour of and against cyber certification; however, it constitutes a powerful instrument against cyber threats, although it cannot be considered as a silver bullet.

The complexity and interdependence of modern technologies needs to be thoroughly considered when new services are deployed. This requires strong collaboration and interaction between authorities, operators and aviation stakeholders. The introduction of AI in mission-critical areas such as ATM which can provide a number of solutions for greening aviation, also brings new challenges. The safety performance of AI applications, as well as the transparency and understanding of the algorithms used (including the type of training datasets) will be a major challenge for the sector.

At the Joint Research Centre of the European Commission, we are the forefront of science advice for policy. Our mission is to provide independent, evidence-based knowledge and science, supporting EU policies to positively impact society. Through our research work on security and resilience of critical infrastructures we provide input to EU policy makers for tackling man-made, geopolitical, environmental and hybrid threats which can have a huge impact on critical infrastructures and critical entities including the aviation sector. Through our foresight work we aim to pick up early weak signals of upcoming threats and challenges. We are also at the forefront of developing the necessary knowledge for new services in the domains of positioning, navigation and timing as well as in advanced communication networks which are important enablers for the aviation sector. The use of EGNOS (European Geostationary Navigation Overlay Service) by airports across Europe for safer, greener and less noisy landings is a great example – the Joint Research Centre has contributed significantly to the development of EGNOS services. Through our work in cybersecurity and in the areas of the skills needed, we are in a position to identify and share best practices with stakeholders in sectors where cybersecurity is mission-critical – aviation is one of these sectors.

This is the key to the future. I think that like many other sectors, aviation will have to compete for talent, particularly when it comes to digital skills, data scientists and artificial intelligence experts, just to name a few. I strongly believe that attracting talent and investing in people will be the most important enabler to tackle future challenges and remain efficient and resilient and in offering even better and affordable services.