Next-Generation Crash Recorders Integral to Aviation Cybersecurity

May 17, 2019

Paul Hart

Stock Photos from Inked Pixels / Shutterstock

On the cybersecurity front, EASA has issued a new notice of proposed amendment (NPA) related to an earlier RTCA document, DO-326A, which came out in 2014. Because DO-326A wasn’t tied to any regulation, it hasn’t been widely implemented since its introduction.

Recent incidents have increased a focus on DO-326A, including an incident last year, during which an airline passenger on board a major international carrier, unwisely thought it would be funny to rename his iPhone’s personal wi-fi hot-spot account, “Bomb Onboard.” During the flight, when the other passengers sought the aircraft’s available wi-fi address, they were understandably frightened to find the prankster’s message. In this case, the crew had to divert the aircraft to address the confusion. When the media got wind of the story, pressure was put on aviation regulators to respond.

That unfortunate incident helped to revive interest and awareness of DO-326A, and EASA has now decided to make it mandatory for avionics vendors to implement the specification. EASA is using a route to fast-track the mandate through legislation and it’s now expected that, within the next three or four months, all new avionics developments will be required to perform a DO-326A cybersecurity assessment.

Paul Hart, chief technology officer, joined Curtiss-Wright in 1982 as a graduate engineer and has worked for 18 years in the flight recorder business. He also worked for Thales for 2.5 years in helicopter flight management and was responsible for the mission systems group at Cobham Aviation Services for 7 years. In 2011, Hart re-joined Curtiss-Wright as the Director of Avionics Engineering and transitioned to the Avionics CTO.