USA Banner

Official US Government Icon

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure Site Icon

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

United States Department of Transportation United States Department of Transportation

Newsroom

Left Nav - Newsroom

57th Annual Air Law Symposium - “Icarus’s Redemption?”

Thank you. It is great to join you all here at this year’s SMU Air Law Symposium.

A father and son share love of experimental aircrafts, so the father – an incredible artisan – builds an elegant craft few could conceive, and he does it mostly from scratch. The father is also widely reputed to be an incredible engineer, so he’s acutely aware of the limitations of his design. 

Before the son helms the inaugural flight, the father gives two words of caution. First, he says, due to an ocean adjacent to the takeoff location, “Don’t get too close to the water.” Maybe the son has scud running in his past, and the father is warning against historic temperament. 

Second, he tells his son that, under no circumstances, should he exceed the craft’s maximum altitude.
Well, the son is giddy about the test, and because things are going really well, he makes a fateful decision. Maybe he’s exhibiting the attitude of invulnerability the Pilot’s Handbook of Aeronautical Knowledge warns us can lead to regrettable consequences. 

But, as likely, the son believes unshakably in his father’s craftsmanship. He’s like Maverick in the Top Gun reboot, and he knows that if he pushes the limit, the craft will stay with him. So the son goes higher and higher above the maximum altitude until the craft absolutely deteriorates, and the son loses control, plummeting to his untimely and unnecessary demise.

Here, the NTSB does NOT investigate…because the foregoing, as I’m sure you have surmised by now, is not recent news; it is, in fact, a modern rendering of the Greek tragedy of Icarus and likely the first recounting of an aviation accident in the history of literature.

King Minos had imprisoned Icarus with his father, Daedalus, in a tower on the island of Crete. Given Daedalus had built the labyrinth that trapped the Minotaur, one would think Daedalus would have been in good standing. But the King punished both father and son upon suspicion they had disclosed to the King’s rival, Theseus, how to escape the labyrinth. One can only hope this reinforces for all in the room how much trouble can befall you if you inadvertently disclose trade secrets. 

As the myth goes, of course, Daedalus made wings of feathers, blanket threads, cloth, and beeswax, and his exact words to his son are to stay far from the ocean, as the salt water could clog the wings, and from the sun, as the heat would melt the wax. 

As with all Greek mythology, the story teaches many lessons. Foremost is that civil aviation authorities and their regulations save lives. Had Daedalus been required to seek a type certificate, there is no way he gets a greenlight for a fixed-wing craft cobbled together by a wax adhesive. At a minimum, we would have seen some serious airworthiness directives. Sadly, had Icarus just followed his flight plan, he probably would have been okay.

The myth also warns of hubris. The phrase “flying too close to the sun” is now cultural shorthand for being incapable of avoiding the downfall of one’s arrogance. The most prominent invocation of Icarus of late was in the musical Hamilton, when Liza laments in the song “Burn” that her husband Alexander flew too close to the sun by publishing public letters from a paramour to clear his name, thus, ruining his family’s.

Countless commentators, though, also suggest Icarus’s tale intends to make us wary of unfaltering confidence in technology – and what we can achieve through it. 

I thought about Icarus months ago when I came up with the title for this address while reflecting on my one-year tenure at the FAA because it seemed emblematic of one of my first experiences. 

In January of 2022, I had just become the lead of an exceptional group of aviation and aerospace legal professionals. And, perhaps, with Icarus-like confidence, I relished the opportunity to take command of aviation and commercial space safety legal issues—with no hint that the next generation of smartphone communications might matter more to my work than my aviation legal knowledge. But the sun burned bright when I realized the first thing I had to do was…become a telecommunications expert! 

The FCC had auctioned off 5G spectrum, thus named because it’s the 5th generation of broadband cellular networks. The major telecom companies paid $22 billion collectively for these frequencies, and stockholders were eager to see their investment in action, and consumers were clamoring for their lightening speeds, which meant activating many base stations. 

As I suspect you know, the problem was the real risk 5G towers operating within a certain distance of airports could interfere with altimeters on a great number of planes. The FAA had made these concerns known through the National Telecommunications and Information Administration, but no resolution followed. Needless to say, air carriers concerned about the safety repercussions joined the FAA in sounding the alarm as the date for ‘flipping the switch’ came due, and that gave everybody a chance to reset.

This had to happen. 5G deployment was being heralded as the next industrial revolution and arguably the most crucial tool in the American toolbox for global competitiveness in our rivalry with China. The last thing the FAA wanted to do is retard deployment, but safety must be, and is, non-negotiable. For countless hours over many months, we engaged in refined interagency collaboration, convening every conceivable stakeholder –  telecoms, airlines, airports, engineers, manufacturers of the adapters needed to make it all work – and we made great strides. As a side note, that work progresses and in mid-January, we issued our most recent airworthiness directive, harnessing research allowing us to restrict operations near airports more surgically.

But back when we broke that initial impasse, I thought, “Well, it hasn’t been without turbulence, but we redeemed Icarus.” The faith was warranted. 

Icarus redeemed also seemed a fitting title because aviation right now is on the cusp of unprecedented technological changes, and we are racing to keep pace, often by employing or modifying our own technology. I asked myself how would we redeem and reform the status quo of the past to ready ourselves for the ever-evolving future?

I thought, “This is perfect!” It became more perfect over the past few weeks when in December, Southwest hit a snag during a holiday bomb cyclone. Then the FAA hit a snag with NOTAM distribution. Then we had Chinese surveillance balloons, I hear, as well as a series of close calls on airport taxi ways. Each one of these incidents raised questions on whether technology did what it was supposed to do or how we might employ it better. At that point, I had to say I became grateful my speech title had a question mark. 

But when I let it breathe for a second, I reflected on the year that was and what’s coming. I watched my colleagues as we systematically worked the problems, and I’m again holding a fervent belief that we can exceed our expected altitudes, and it isn’t hubris.  This is redemption.

Today, I want to pull back the curtain on the year that was for the FAA and the Chief Counsel’s Office to explain why. I have to disclaim that no Chief Counsel can show it all. There are issues connected to enforcement actions or items we are still working through, and, thus, you might not get the full reveal. But I hope I can be an honest broker and give a fair-minded assessment of the policy trade-offs, for example, of some of key issues confronting the FAA. Aviation and aerospace? The planet? As we ask: What IS the state of aviation, and relatedly, the state of aviation law? How do we redeem the law of the heavens? Or at least the National Airspace System?

One thing we know is the 2.3 million passenger per day load will increase by 50% come 2027. And we may be understating. An Ipsos poll two weeks ago had 40% of Americans saying they’d travel more if their experience were less hassle, and they listed security as an issue.

By show of hands, how many of you have PreCheck? How many of you have Clear? This is no surprise because this group is aviation savvy, but 33% of Americans have never even heard of PreCheck and twice that percentage don’t know CLEAR. Enrollment rates are 17 percent for PreCheck & three percent for CLEAR, and it’s only marginally better among business travelers. As we improve the customer experience, as we must, we’ll continue to gain patrons.

And they’ll be in increasingly crowded skies. By 2025, you may be able to get from some major city airport to its downtown in a four or five-person eVTOL for what the companies provided this service claim will be $3-4 per mile. In addition, we anticipate that the number of unmanned aircraft systems (UAS), or drones, will increase dramatically. Right now, the FAA has about 860,000 registered, with about 500,000 belonging to hobbyists. By 2023, that number balloons to 2 million in some industry projections, and the ratios will flip to predominantly commercial purposes, which means consistent presence in the sky.

That means we have a lot to get right. Our redemptive actions of late makes me think we will.


Acting on Safety
When the FAA saw six close calls on taxiways over a few weeks, it immediately began a sweeping safety review and called a summit for the first time in 14 years, which it convened with over 200 safety leaders two weeks ago. During that Summit, Acting Administrator Billy Nolen was anti-Icarus, noting a hallmark of a life in aviation, which is the willingness to question conventional wisdom and ask hard questions.

This unflinching attitude redeemed us. Because, contrary to how most of America seems to communicate on social media, little is black and white. Every public policy decision has trade-offs, and he rightly asked whether we are emphasizing efficiency over safety. Comfortable safety professionals are missing something, and maybe we have a little hubris in a system brought on by over a decade of safe skies.

Then, based on the findings, we issued a safety alert to airlines, pilots, and others about the “need for continued vigilance and attention to mitigation of safety risks.” This was the only generally applicable second safety message over the past two years because it’s an all-hands on deck moment.

The day after, we started on the rulemaking process to require cockpit voice recorders to capture 25 hours of information and establish a committee to explore how to make greater use of data gathered by airplanes, including expanded flight data monitoring.    

But this work is just the continuation of a number of safety efforts.  First, the FAA finalized its rulemaking for airport Safety Management Systems (SMS), designed to reduce accidents and fatalities by proactively identifying hazards at 200 of our busiest airports, and our airports office is leading training this month.

We also did a notice of proposed rulemaking that expands SMS to commuter air carriers, air tour operators, and manufacturing organizations.

Three weeks ago, we completed another mandate from the Aircraft Certification, Safety, and Accountability Act, which required applicants who want to modify original transport category aircraft designs to disclose all proposed changes in a single document at the beginning of the certification process. 


Timing 
We’re also being redeemed through intentional vigilance. If there are silver linings to recent events, it’s been the timing of it all. First, when we had our first safety summit since 2009, it was fully preventative – this wasn’t following a tragedy. Second, these incidents are are happening during reauthorization. Congressional interest and action is at peak levels. We have full engagement across committees and member offices.

In response to the NOTAM situation, on our side, we immediately staggered data backups and instituted duplicate monitoring to ensure no repeat of the ground stop. On their side, the Senate Commerce Committee passed a NOTAM Improvement Act, which creates a task force of stakeholders with an implementation of the Federal NOTAM system and a backup by September 2024. The House already passed an identical provision. Redemption was that fast. 
(Candidly, you never want to inconvenience the public, but I was proud the FAA did not let fear of the reaction keep us from ensuring everyone’s safety.)

Ultimately, it will be up to Congress and the President to decide what goes in the next FAA reauthorization and what our appropriations look like. We look forward to working with our legislative branch partners on both, so that the next bill better reflects our renewed mission and goals over the next five years until the next reauthorization. There is certainly Congressional interest in ensuring the FAA receives the resources it needs for personnel and new technologies.


Reauthorization Timing
One benefit of this perfect storm of opportunity is that we get legitimate debate on FAA-adjacent policy ideas that are outside our rubric. As a classic example, three weeks ago, the FAA prevailed in a lawsuit against Flyers Rights, which alleged the 2018 Reauthorization Act required the agency to establish minimum seat size and pitch. 

What School House Rock called “conjunction junction” carried the day because the reauthorization said the FAA shall issue regulations that establish minimum dimensions and are necessary for passenger safety. The FAA conducted 300 evacuation simulations, consistent with testing protocols, and studied other data of exits and concluded a safe evacuation in 90 seconds with current seat dimensions was possible. Judge Justin Walker for the majority noted our conclusion meant that not only was the FAA not required to, but it was barred from changing seat sizes. 

Congress’s reaction could be one of three things: 1. Do nothing. 2. Say, “We meant to say create a standard and make it safe; or 3. Agree with the D.C. Circuit’s interpretation and do what Senate Aviation Subcommittee Chair Tammy Duckworth did, which is introduce a bill mandating an evacuation standard and alter the way we evaluate the evidence. Senator Duckworth’s EVAC Act, introduced in December, would require the FAA to take into account those “real-life conditions” in its testing, such as children and seniors, passengers with disabilities, non-native English speakers or those who are non-verbal, and impediments like luggage in the aisle.  

The desire for more space is understandable. Believe me, I know. I’m not on a stepstool at this podium. The average American is a couple inches taller, a half-dozen inches wider, and 30 pounds heavier than decades before. This is likely why, when members of Capitol Hill asked the public to comment on whether the FAA should change seats, we got 26,000 messages with “cramped, crammed, crushed, squeezed, and squished” as the top five descriptions of the experience. But we have countless safety goals to pursue, and consumer preferences are not policy, so we’ll see how this plays out. If Congress makes seat size its priority, we’re duty-bound to make it ours.

We also may have additional action on UAS detection and mitigation (counter UAS), a task made much easier this year when we won a challenge to the Remote ID rule in the U.S. Court of Appeals. This win was crucial. Drones have countless valued uses – from infrastructure inspection to search and rescue to medical deliveries. But we – and I don’t mean the FAA exclusively here – have to protect the skies from nefarious purposes, such as contraband dropping into prisons or assassinations. In 2022, there were 1700 incursions at airports, and drones near or around temporary flight restricted areas are common. Reports of UAS sightings from pilots, citizens, and law enforcement have increased dramatically over the past two years. The FAA now receives more than 100 such reports monthly. 

To respond, the FAA will require Remote ID, which is a “digital license plate,” by September of this year. Every registrable drone will have a Remote ID – either in the drone or on an attachable module, so we’ll know where it is, to whom it belongs, and how to track it.

This year, the Court of Appeals for the D.C. Circuit rejected 4th Amendment privacy concerns and procedural challenges to Remote ID, noting that there is no expectation of privacy, though it held open whether an as-applied challenge might prevail. The Court also left open avigation rights, which could have helped us inform or clarify current thoughts on preemption.

Ahhh, yes, we’ve come to the pièce de résistance. One issue occupied so much of my time in my first year I toyed with titling this speech, “Icarus’s Preemption!” 

The preemption issue warrants more fresh eyes and further intellectual engagement. The debate now features predictable advocates and talking points on each side, so much so they evoke Ralph Waldo Emerson’s essay, On Self Reliance, when he says “If I know your sect, I anticipate your argument.” 

The core contentions are so familiar, advocates for each side deploy a common vocabulary. One of my favorite things about preemption discussions is I’m guaranteed to hear the terms “hodgepodge” and “patchwork,” some of the preferred jargon for those who prefer a more limited role for the states. 

And for those who feel the FAA should leave well enough alone, I get doses of the apocryphal Thomas Jefferson quote about “the government being best that is closest to the people” or Louis Brandeis’s reference in New State Ice Co. v. Leibman about states being the “laboratories of democracy.” It’s a great metaphor because states can experiment with a variety of solutions in sundry areas of law, allowing us to gather data and assess which is most meritorious. We can find examples that bolster this notion with ease. But for an experiment in Massachusetts, one wonders if an Affordable Care Act would exist today. In contrast, invoking preemption widely results in…anybody want to guess my next phrase? The dreaded “one-size-fits-all” solution. 

Ironically, the same arguments on preemption are playing out within states, though in other policy arenas. In 2021, state legislatures passed over 400 different laws restricting the rights of hamlets, towns, cities, and counties to self-govern. Perhaps the thinking is that closer to the people is better, but just don’t get TOO close (sort of like maintaining the political equivalent of social distancing).

Preemption in all its forms is staggeringly nuanced – both context-based and fact-specific – and it bears noting that, as a complication, federal action is viewed with more circumspection under the current Supreme Court and the commentariat than in some time.

In Law & Leviathan: Redeeming the Administrative State, Cass Sunstein does a blunderbuss treatment on the critics of federal encroachment, saying that what they see is, and I quote, “an administrative apparatus wielding executive powers of frightening scope and power that threaten to undo the original constitutional structure, and produce unaccountable and undemocratic policy making.” Well, who would want to be part of that? 

The current court, starting in 2019 in earnest, also took a paring knife to the deference courts must afford federal agencies, especially when they construe their own regulations. In Kisor v. Wilkie, Justices Alito and Gorsuch, in particular, seemed to see Three Card Monte in the enterprise with the agency as its own shill. If you give license to an agency to resolve the ambiguous terms in its own regulation, won’t it just write ambiguous terms? Of course, this is an outgrowth of Justice Scalia’s belief that agencies should never become de facto judiciary by interpreting any federal law. But does the judiciary become the de facto regulator when their interpretation of ambiguous statutory language is the only permitted pathway?

And to add another layer of cabining of federal actions, let’s just say that if legal arguments could be given “most improved player” trophies, the “major questions” doctrine would have won back-to-back in 2021 and 2022. What was once an inquiry of “What does the text say” is now an incredulous side-eye that’s more akin to, “Sure, on its face that’s what it seems to say, but this is REALLY major!” And Congress passed this law before anybody even knew about (insert technology or condition that didn’t exist). Plus, “the agency has never done something like this before,” as if an agency going from restrained to a bit more verve could somehow alter text. It makes one wonder if it is hubris for the courts to define unilaterally what is a “major question,” a term and judicial precept nowhere to be found in the Constitution?

And, of course, going from general notions to the particular, you may say in retort, Congress was absolutely clear in the Airline Deregulation Act. It expressly stopped states from implementing any laws relating to rates, routes, or services. But Congress is often not precisely clear, and if they were so here, courts have certainly spent a lot of time interpreting what “relating to” could possibly mean.

This is what is becoming of our use of or reliance on legal language and interpretation. And this “. . . systematic looting of language,” as the Nobel laureate Toni Morrison reminds us, “can be recognized by the tendency of its users to forgo [language’s often] nuanced, complex, mid-wifery properties for menace and subjugation.” 

The Fifth Circuit spoke to many of these points last year in the case of Jarkesy v SEC. The Jarkesy case brings many of these points to life but was best summed up by Columbia Law Professor John C. Coffee Jr when he pondered, “when will a legislative delegation of authority to an agency be respected.” This is the doctrinal repositioning on government agency authority that is helping to spin our basic understandings out of control. As Professor Coffee noted, this is likely only the beginning. For example, what of the dormant Commerce Clause in limiting the authority of states where state legislation may have extraterritorial impact? The Supreme Court granted cert in a case this term called National Pork Producing Council v. Ross out of the Ninth Circuit to answer this exact question.  

Now that I’ve set the table, where’s the meal, right? I’ll bite. Bernstein is a case you know intimately or consciously avoided, so I’ll shorthand it. The Supreme Court denied cert on a 9th Circuit opinion that said generally applicable meal and rest break laws in California applied to flight crews and were not preempted by the Airline Deregulation Act, which expressly bars states from enacting or enforcing any law relating to rates, routes, or services. 

This may be an urban legend, but I heard this California meal and rest break law existed for some time, but it was not enforced until a class action lawyer learned about it during a dinner party. This might make some of you rethink any upcoming guest lists, I suppose. 

In any event, solid scholarship has flourished on both sides of this case.  As Daniel Rosenthal and Michael Ellement argued in the Air & Space Lawyer, except where clearly intruding into areas of federal responsibility, state and local governments should be free to use their judgment to increase base¬line employment protections, particularly where Congress has failed to keep pace with economic changes and the evolving nature of work.

They add that nothing in Morales v. Trans World Airlines, the key case that defines what “relates to” means, or any other Supreme Court opinion, suggests that preemption should apply to any law whose downstream effects on prices, routes, or services are significant when that law has no direct connection to those core concerns of the ADA.
Of course, we must acknowledge that even employment provisions are immensely more complicated in aviation than in any other industry by virtue of how carriers schedule and how quickly employees change states. 

When I flew from D.C. to Northern California to tour a NASA lab and conduct site visits with UAS manufacturers, I occupied 10 states at different times. It doesn’t mean it’s impossible for carriers to figure it out, but it does mean squaring methodologies among stakeholders with divergent interests could be elusive.

So, what has the Golden State fall-out been? Maybe the fastest legislative fix in California history. Alaskan Airlines said, “Hey, we weren’t kidding. We’re moving crews out of state,” which gave rise to Senate Bill 41, which Governor Newsom made law last week on an emergency basis.  

The law says airline cabin crew employees are exempt from California’s meal and rest break laws, provided those provisions are addressed under a collective bargaining agreement or if the employee is represented by a bargaining unit that doesn’t yet have a CBA, they get 12 months. Also, the bill grandfathered in all claims filed before December of 2022. Great job, plaintiff’s bar! Redemption achieved!

I won’t opine on whether a more suitable resolution was reached through legislative wrangling, but the collective vote in the two legislative chambers was 110 to zero, which seems unprecedented in modern political life.

We have many decisions to make in the near future, mostly around UAS and eVTOLs, and this issue, too, is complicated and fascinating. Public observers hope these new market entrants don’t fly too close to the sun, or their homes.

Recognizing this imminent issue, an article authored by Sandra Day O’Connor School of Law Professor Troy Rule, released under the auspices of the Mercatus Center at George Mason University, contends that the best way for drones to flourish is to recognize that property owners have rights to keep crafts from flying over their homes. 
Once those rights are solidified, owners would use apps to put their slice of sky up for auction, and then each delivery becomes an income stream for all the owners over whose homes drones fly. One might appreciate the equity in having such a colossal economic enterprise as drone delivery services sharing the wealth. The drone delivery market will appreciate from $1 billion to $32 billion globally by 2030, and from $220 million to $5.5 billion in the U.S. You have to think offering even the top crust of that pie would improve drone public acceptance. 

But there’s a snag. Professor Rule contends UAS companies are on the offensive to extinguish those rights, using federal preemption as their implement, prompting Rule to observe, “The FAA has proven to be a willing partner in the effort to reclassify very low airspace and thereby expand FAA jurisdiction and increase the agency’s size and relevance—changes that federal agencies characteristically tend to favor.” Ouch. That’s some serious shade.

Rule also argues the FAA has eroded property owners’ rights one pilot project at a time. By not even speaking to overflight, the theory goes, we’re lulling homeowners. Well, he’s right about the projects but wrong on the motivation. In 2022, the FAA issued 103 waivers that were beyond visual line of sight for UAS. Those are about the FAA helping accumulate research and prove the technology. That’s why the FAA has 7 UAS testing sites, studying things like ground-based radar and traffic management, violent weather and temperature extremes, multi-spectral cameras for infrastructure evaluations, counter-UAS activities, ground and air detect and avoid, and injury risk assessment.

Moreover, Professor Rule’s work seems to omit the notion that the FAA’s congressional charge to integrate drones into the NAS safely doesn’t mean just keep them away from commercial and GA crafts or eVTOLs. A craft in the sky can always be a danger to person and property, which is why the FAA takes such great pains to certify drone pilots and will track who operates UAS through Remote ID. It isn’t just for fear they’ll fly too high and endanger general aviation craft, though we have countless instances where pilots report interactions. It’s the same reason visual line of sight matters. Safety. 

We ensure that all things in the sky do not inflict injury on person or property, and that is why we regulate any craft that is in the sky, and why we contend, and will continue to maintain, our jurisdiction goes down to a blade of grass.

Plus, think of the millions of new UAS I referenced. Do we think accumulation of crafts in some holding pattern because a locality or state tried to dictate where UAS could fly could never create danger or constitute control of routes? We at least have to admit that it will certainly be intriguing as this issue moves forward.

In equipoise to Professor Rule, Sara Baxenberg and Josh Turner rightly added to the discourse in “As the Drone Flies” that where courts and state laws have recognized rights to air in some way separate from the surface, no legal regime has allowed a person to own airspace to the exclusion of aircraft. 

But that wasn’t always our thinking. In a culture descending from Icarus’s Greece, Roman law dictated that “He who owns the soil owns everything above and below, from heaven to hell.” Before the advent of aviation and for decades after, this legal maxim held sway under the theory of transient trespass.  

Then in 1946, in United States v. Causby, the Supreme Court declared, “air is a public highway,” and deflated the notion, noting the idea (and arguable arrogance) of owning up to the heavens “has no place in the modern world.” The Court redeemed our legal tradition by applying nuisance law to aviation—holding that a government taking occurs when the government’s aviation laws interfere with the enjoyment of property. This pragmatic approach sought to balance the needs of aviation with the reasonable, expected use of property. 

It is God-like pride for a landowner to believe that they should control what occurs 20,000 feet above them. But any person would want to move, and receive damages, if, like a scene from Top Gun, military jets buzzed by their windows, rattled their home, and spilled their morning coffee. Our Icarus past should continue to be redeemed in a practical manner for UAS—just as the fair-minded justices redeemed our antiquated view when the Court decided that aviation had made the old Roman understanding of the law obsolete, while providing damages to those who suffered from novel aviation nuisances. But perhaps it’s still all Greek to me?

Now what is that exact balance between the interests of UAS, property owners, and the public? It would be hubris of me to dictate a rulemaking in this moment. And my regulations counsel and Administrative Procedures Act experts would be none too pleased. Although we may not anticipate every single UAS issue with prescient precision, the FAA will work to adapt our positions to the modern marketplace and current safety concerns. 

But the clincher is that the FAA will listen to all stakeholders and members of the public as we attempt to redeem and revise our regulations for the brave new world of UAS and aviation. Rest assured, we will not fly too close to the sun, nor too low to the sea. Our flight plan will be a just right Goldilocks moment and never the over-confident Icarus. But perhaps given the numerous novel and evolving issues across aviation, from UAS to airport infrastructure, we will—sometimes—be Icarus revised, reformed, and, hopefully, continuously redeemed. 


Thank you.
 

FAA Closes Blue Origin Mishap Investigation

The FAA has closed the Blue Origin New Shepard 23 mishap investigation. The final report cites the proximate cause of the Sept. 12, 2022, mishap as the structural failure of an engine nozzle caused by higher than expected engine operating temperatures. The FAA required Blue Origin implement 21 corrective actions to prevent mishap reoccurrence, including redesign of engine and nozzle components to improve structural performance during operation as well as organizational changes.  

...

What a Tangled Web: Aviation Prosperity, Cybersecurity Risk

Thank you, Professor Truxal, for the kind introduction, and thank you to Leiden University (and the Ministry of Infrastructure and Water Management) for the invitation and for hosting this conference. 

It’s a privilege to be in the Netherlands, a nation with which the United States not only has a long-standing relationship in aviation, but also, a history-making one. 

Just over thirty years ago, our Department of Transportation entered into an “open skies” agreement with the Netherlands, thereby opening our markets to each other for the first time with a European partner. Then, three years later, our two nations signed the world’s first bilateral aviation safety agreement (BASA). Both of those efforts led to comparable agreements throughout Europe, so it seems sporting to accord Amsterdam the status of catalyzer for American aviation.

What I can say without reservation is that the Netherlands is certainly in that role today. The thought leadership Leiden University fosters today will undoubtedly strengthen all of our respective efforts to protect our digital aviation infrastructure. 

This conference comes at a crucial time in that effort, speaking candidly. We are on the cusp of what will be aviation’s most cutting-edge epoch, driven principally by technological evolution at an unfathomable pace and its integration into nearly every aspect of our current air travel and good delivery experience.   

To acknowledge the cyber defense challenges attending that evolution is not alarmist. It’s reality. It is reading a website on your phone two months ago and learning that seven, small German airports experienced Distributed Denial of Service, or “DDOS” attacks, which I suspect most of you know are attempts to crash websites by generating overwhelming traffic. It’s turning on your TV and seeing that less than a month ago, the pro-Russian hacker group, Killnet, executed DDOS attacks on Eurocontrol. It’s hearing on the radio that this is Killnet’s modus operandi because it did the same at fourteen U.S. airports last year. Did any of these efforts amount to more than nuisance, website disruptions? No. Because all of us contributing to this effort examine as many data points as possible. 

We look at assessments from private and governmental actors and can reasonably anticipate the type and number of threats will continue to increase, as will the diversity of malicious actors. None of those prognostications is worrisome precisely because we readily admit what we confront. 

We know the only way to travel risk-free is to never move.  Instead, we game out every conceivable scenario to keep that risk as close to zero as possible because we know the humanitarian value in shrinking the world and facilitating cross-cultural exchange at events like this is too beneficial to forego. 

We know the immense economic benefits of aviation improve far too many lives to be any less steadfast. To appreciate the scale of which I speak, the world’s airlines carry over four billion passengers and nearly 61 million tons of freight per year, creating almost ninety million jobs and adding $3.5 trillion to global GDP. The Air Transport Action Group predicts that by 2038, it will be 143 million jobs and $6.3 trillion. 

Of course, it’s precisely the industry’s financial strength and the stabilizing impact it provides nations through economic growth that make aviation such a tempting target for cybercriminals of all stripes.

We have not only rogue actors and state-affiliated hacking groups, but also nation-states attempting to undermine global cybersecurity. According to the U.S. Cybersecurity and Infrastructure Security Agency, both the Chinese and Russian governments have engaged in malicious cyber activities to pursue their national interests and have targeted the aerospace sector. Aviation regulators and the aviation industry must be prepared to adapt to all cybersecurity threats, no matter the source.

The threats we have articulated speak to the existing aviation airspace, which will become increasingly complex. First, we will see an exponential growth in aircraft in the sky. In the U.S., for example, we already have approximately 860,000 registered remotely piloted aircraft systems, or RPAS, the majority of which are hobbyist-owned.  That number is expected to grow to over 2 million within the next five years, with commercial drones constituting the majority.

As with any aircraft, there are vulnerabilities. RPAS customarily rely upon communication links between the controller and the aircraft to fly safely and receive frequent software updates that may contain anything from computer data needed for flight to geo-fencing to keep drones out of restricted airspace. As Eurocontrol notes, some threat concerns include resulting loss of control, theft of the craft or payload, or use of a platform for jamming, spoofing, or eavesdropping.

In addition, we have exciting emerging entrants in Advanced Air Mobility, or AAM, who will challenge us with new cybersecurity risks.  Recently, I toured manufacturing facilities in California for several companies pioneering eVTOLs (electric vertical takeoff and landing vehicles), or what we also call powered lift, or air taxis.  At some point in the next ten years, provided the aircraft meet the FAA’s requirements for safe operations, we anticipate people leaving Los Angeles International Airport, and via ridesharing-style booking, being able to take an eVTOL into the city center for what these companies claim will be only $3-4 per mile.

These aircraft are designed to simplify flying, and one prototype boasts five seats…with no pilot in the plane. I ask people often about flying in pilotless aircraft. By a show of hands, who here would be willing to take the inaugural flight if you knew you had a supervisor on the ground ready to intercede?

There is incredible enthusiasm for this segment, as these crafts are more environmentally friendly and less noisy than many existing options, but as is true with any aircraft, the public must trust their cybersecurity implicitly, especially if and when AAM moves to an autonomous phase.

Several months back, as I contemplated our future cyber challenges, Sir Walter Scott’s most famous and multi-faceted line from his poem “Marmion” sprung to mind: “Oh, what a tangled web we weave when first we practice to deceive.”

The quote resonated most obviously because “the worldwide web” is host to the threats themselves, coming from a tangled web woven within our national and global networks, which have numerous potential cyberattack vectors. And at their core, all of these attacks are based in deception.

But I also thought about the image of a spider web as aptly describing our complementary and intersecting efforts in cyber protection. Each private company or contractor, each government entity, each NGO, adds strands, often overlaying another, and while it may be construed as tangled, even when there seems to be daylight, we catch almost everything that attempts to infiltrate through that web. It’s a symbolic rejoinder to critics of the progress we’re making to date.

As a public servant, one of my highest charges is ensuring we never lull ourselves into a false sense of cybersecurity. We must conduct an honest appraisal of our mutual perils, and this serves us better.

How, then, does the U.S. contribute to the strength of our web of defenses? 

On March 1, 2023, the White House published the Biden Administration’s National Cybersecurity Strategy to guide U.S. cybersecurity policy and infuse it with our shared values of freedom and democracy in order to create an affirmative vision for our interconnected present and future.

As White House National Cyber Director Kemba Walden noted recently, technology is “values neutral.” It can bring democracy-affirming advancements, transparency and privacy protection, or surveillance, cyberintrusions, and digital authoritarianism. It’s incumbent on all of us to craft a lattice that installs democracy-affirming features into our technology. With this purpose, the National Cybersecurity Strategy established the foundation for five pillars of cybersecurity: (1) Defend Critical Infrastructure, (2) Disrupt and Dismantle Threat Actors, (3) Shape Market Forces to Drive Security and Resilience, (4) Invest in a Resilient Future, and (5) Forge International Partnerships to Pursue Shared Goals.

Today, I will talk about pillars one, four, and five, which are most applicable to the FAA.

Defending Critical Infrastructure…

As many of you know, in the United States, the federal government provides air navigation services, through the FAA’s Air Traffic Organization (ATO). In accordance with the First Pillar, the FAA is investing in long-term efforts to implement a zero-trust architecture strategy and modernize informational and operational technology infrastructure by funding multiple zero-trust architecture projects, as well as other efforts to buttress the security of our networks to the greatest extent possible.

Furthermore, the FAA has expanded its cybersecurity partnerships through the Aviation Cyber Initiative (ACI). The ACI is a U.S. government task force comprised of the U.S. Department of Homeland Security, including the Transportation Security Administration (TSA), the U.S. Department of Defense, and the FAA. ACI focuses on identifying and addressing cybersecurity risk and ensuring cyber resilience of the nation’s aviation ecosystem.

Most recently, the TSA issued a number of cybersecurity-related changes to airport and aircraft operator security programs. These changes require the development of network segmentation policies and controls to ensure that operational technology systems can continue to operate safely in the event that an information technology system has been compromised, and vice versa; the creation of access control measures to secure and prevent unauthorized access to critical cyber systems; implementation of continuous monitoring and detection policies and procedures to defend against, detect, and respond to cybersecurity threats and anomalies that affect critical cyber system operations; and timely security patches for cyber systems.

The FAA is supportive of TSA’s recent aviation-focused cybersecurity enhancements, which will help United States airport and aircraft operators improve their cybersecurity and resiliency.

Moreover, the FAA partners not only with TSA, but also, with the Cybersecurity Infrastructure Security Agency (or CISA), the Federal Bureau of Investigation, and the Intelligence Community to monitor, assess, and communicate on adversarial cyber capabilities and threat activities, supporting and informing cybersecurity and resilience efforts across the Aviation Ecosystem.

Furthermore, the FAA has a robust and adaptable cyber-risk model in place to support our extensive traffic mission and related systems. The FAA will continue to prioritize cybersecurity research and development activities to keep us ahead of evolving cyber threats and risks. 

The FAA has substantial regulatory authority to oversee the safety of civil aviation, from aircraft, to airspace, to aviators. 

The latest aircraft coming off the assembly lines constitute the most visible example of our expanding aviation cyber connections.  

During the FAA’s certification processes, manufacturers are required to address cyber risks when they apply for design approval or a change to a previously certified product. Electronic systems must be designed and installed to perform under any foreseeable operating condition, including cyberattacks.  The FAA’s regulatory authority for civil aircraft ensures cyber risks are managed through the application of design-specific “special conditions.”

The FAA applies the special conditions when the current airworthiness regulations do not contain adequate or appropriate safety standards for a new or novel design feature. These special conditions carry the weight of regulatory requirements and mandate that critical aircraft systems be protected from intentional unauthorized electronic interaction. 

Once an aircraft is in service, the FAA addresses cybersecurity safety by monitoring safety impacts using a data-driven methodology.

Invest in a Resilient Future

We do so at American airports by encouraging our stakeholders to invest in cybersecurity and including cyber-security-related conditions in certain FAA grants.

The FAA has required that airport grant recipients consider and address cybersecurity related to the expenditure of public funds. Prior to receiving construction funds, this cybersecurity requirement must be met.

The U.S. has devoted resources as well. For the Airport Terminal Program, U.S. Department of Transportation Secretary Pete Buttigieg announced the Department’s intent to spend nearly a billion dollars on 104 projects at 99 airports. Additionally, 40 discretionary grants totaling $144 million will go to airports. For the FAA Contract Tower Program, the DOT will fund 33 projects at 29 airports for $20 million. All of these grants will have a cybersecurity compliance component in the grant agreement.

Forge International Partnerships to Pursue Shared Goals

Perhaps of most interest to all of the diverse nationalities assembled here is the US commitment to “build a broad coalition of nations working to maintain an open, free, global, interoperable, reliable, and secure Internet.”

In furtherance of this goal, the FAA advocates engagement in cyber policy drafting discussions with ICAO and other bodies. Correspondingly, the FAA occupies the US Panel Member role for ICAO’s Cybersecurity Panel and the Trust Framework Panel. The latter seeks to develop provisions and guidance to support aviation stakeholders’ ability to have confidence in the integrity and source of digitally exchanged information.

The U.S. collaborates closely with our European partners, including EASA and EUROCONTROL. For example, at the first ICAO Trust Framework Panel meeting, the US and EU declared that the panel should prioritize the development of provisions and guidance to support globally harmonized information security management system (ISMS) implementation; the development of provisions and guidance to support globally harmonized digital identity (DI) implementation;  review practices to ensure ISMS and DI provision compliance; and activities that support information security capacity building for aviation stakeholders.

As a robust partner in these efforts, the United States will marshal expertise across domestic public and private sectors, and concurrently work with our international partners to pursue coordinated and effective international cyber capacity-building and operational collaboration efforts.

The US and Europe need to coordinate to achieve our goals, which should also embed our values in the enterprise. But we should not forget that many different methods can craft resilient and adaptable cyber networks. Although we may spin our webs with varying techniques, our shared goals of preserving the confidentiality, integrity, and availability of information systems shall remain paramount.

Today, if a cyber-incident occurs, we can’t just rely on rule enforcement and punishment.  We also need to learn what happened, why it happened, and what we can do to adapt our aviation ecosystem and prevent the cyber incident from happening again.

Despite speaking in a different context, one of America’s greatest philosophers and heroes, Dr. Martin Luther King, Jr., stated in his “Letter from Birmingham Jail” that injustice anywhere is a threat to justice everywhere. Similarly, a threat to cybersecurity anywhere is a threat everywhere. Cyber threats never tire, and neither must our cyber defense.

As the technology of the aviation ecosystem evolves, we expect that cybersecurity challenges will continue to evolve and will require vigilance and ongoing risk management. Our duty compels us to deploy in-depth security principles—adding layer upon layer of defensive measures. Also, we must act on threat information, detect attacks, and follow up with remediation and updated best practices throughout our diverse network.

As the U.S. civil aviation authority and air navigation service provider, the FAA exists at the crux of the web responsible for promoting safe, secure, and efficient Aviation operations. As we practice what we preach, I am confident that the FAA’s aircraft certification process, from design to manufacturing certification, has ensured robust cybersecurity protections for our nation’s aircraft fleets.  Once these aircraft lift off, the FAA will continue to keep our internal and navigation services fortified and resilient to maintain our services to the thousands of aircraft in our skies in a single moment.

The FAA’s work and policies implement the United States' commitment to National Cybersecurity Strategy five pillars from the FAA’s internal and external investments in defense to international collaboration.

As international aviation leaders, we cannot haphazardly tie together our cyberspace. Instead, we must carefully design and craft an architecture built to last that can be improved on and defend ourselves against the many avenues of attack available to ill-intended entities.  We live in the tangled international aviation webs we have interwoven, and our shared burden is to build an ever-adapting cyber defense system.

Thank you.