MEETING THE AIRCRAFT SECURITY CHALLENGE

Report of the Secretary's Rapid Response Team on Aircraft Security

October 1, 2001

The threat to aviation safety has changed, and so must our response. The events of September 11 changed forever our concepts of appropriate aviation safety. The use of a hijacked aircraft as a weapon requires a new strategy to ensure that the crew always retains control of the aircraft.

To combat the new threat and restore public confidence in commercial aviation, this report documents our consideration of changes to aircraft design and operation. Augmented by the suggestions and recommendations received from all sources, one or more of the following goals 1) to deter the hijack plan, making it too difficult, expensive or undesirable to use aviation as weapon of terror; 2) to deny access to the flight deck by any threat; 3) to delay access to the flight deck, allowing the crew time to take protective measures; 4) and to recover control through aggressive crew response.

To build on the President’s proposals and make the Nation’s aircrafts secure, the Rapid Response Team has concluded that:

· Some appropriate flight deck barrier device must be approved and installed in the entire U.S. fleet and future design of flight deck doors must meet newly determined requirements.

· Procedural changes must be made at all airlines regarding identification and access of all personnel to the flight deck.

· Airline industry, unions, and FAA should redesign security training with possible implementation of defensive capabilities to address newly-identified threats, incorporate changes into the annual curriculum, and provide security training to all crewmembers.

· Each airline, in cooperation with the FAA or other government entities must develop a delivery system to provide government security advisories to crewmembers in a timely manner.

· A task force should determine the necessary modifications to assure continuous transmission of a transponder signal.

· All airlines, pilots and the FAA should jointly identify procedures in pilot training that could be adapted in an attempted hijacking.

This report addresses the security issues that arise at aircrafts in connection with travel on commercial airlines. A detailed discussion of specific actions follows.

A separate Rapid Response Team will report on security issues arising in connection with aircraft construction and operation.

Finally, the Team wishes to underscore its conviction that the measures proposed in the pages that follow can and should be implemented in a way that is wholly consistent with America's commitment to the protection of civil rights.

RECOMMENDATIONS

Flight Deck Door Design

Recommendation 1: We recommend that some appropriate barrier device be approved, and installation begin within 30 days. Installation throughout the entire U.S. fleet should be completed in 90 days. We recommend that FAA enable the installation of these devices through urgent regulatory action that provides the airlines with a simple, expedited method for approval and installation.

The multiple attacks of September 11, 2001, require that changes be made to the flight deck door that will deny access to an intruder. The safety requirements related to rapid decompression and emergency access, however, must be considered. Flight deck doors on U.S. airline aircraft were designed principally to ensure privacy, so that pilots could focus on their normal duties, uninterrupted by activity in the passenger cabin. Doors were not designed to meet significant security threats such as small arms fire or shrapnel, or the use of blunt force to enter the flight deck.

The prevention of unauthorized access can be improved by the simple addition and use of a deadbolt, a cross‑bar, a net or other barrier devices. Our discussions and consultations with other aviation experts indicate that this installation on any individual aircraft can typically be accomplished overnight.

Besides affording an orderly work environment for the flight crew, flight deck doors have other important safety characteristics. Current design standards require that the door must not hinder emergency exit from the flight deck or impede rescue efforts into the flight deck after an accident.

Current doors are designed to ensure that rapid decompression does not cause a failure, which could have catastrophic effects on the aircraft. Such a failure is theoretically possible in such an event, if the pressure cannot be equalized between the flight deck and the cabin in an expeditious manner. Preliminary research indicates that a rapid decompression on the flight deck side of the door has a low historical occurrence. This research has revealed no accidents caused by a rapid decompression in the flight deck. This may be because the decompressions have not been rapid enough or the venting method worked as designed.

The addition of a deadbolt or another barrier may hinder crew exit, rescue, and the venting that the door’s original design provided. Given the newly identified security risks, we recommend the FAA allow the use of a deadbolt or other barrier device, in the short-term, until the impact of these devices on decompression and rescue/exit can be determined and an alternative approach is designed.

Recommendation 2: We recommend that the industry identify and address the risks regarding rapid decompression and exit and rescue associated with the barrier devices that have been installed. Within 6 months, steps should be taken to accomplish the following:

(1) Approve a door design to ensure:

· adequate venting of a closed and locked flight deck door in the event of a rapid depressurization in the flight deck area. Venting may involve provision of either a venting means or release of the door locking mechanism,

· in the event of an emergency, exit and rescue of the flight crew, and

· barrier against intrusion.

(2) Provide a barrier against access by an intruder through the venting feature of those flight deck doors having vents.

Within 1 year from approval of the door design, conduct a retrofit of the entire U.S. fleet of aircraft.

There may be more permanent and effective solutions that require longer time for implementation. The current flight deck door and associated bulkhead are not designed to minimize or mitigate the negative impacts from breaches caused by blunt force, ballistics, fragmentation, or other explosive effects.

Strengthening of the flight deck door can be divided into the following areas: (1) Improved locking, hinge, door handle, and door frame integrity; and (2) Using specialized materials to mitigate the catastrophic effects from ballistic, fragmentation, and explosives devices attacks. A design and performance specification with specific design requirements must be developed and approved which would include identification of the amount of load(s) the door and bulkhead must sustain from an attack and take into account the force that can be expected in an explosive decompression.

Recommendation 3: We recommend that ongoing work in the Aviation Rulemaking Advisory Committee Design for Security Harmonization Working Group be completed within 60 days, with respect to door design standards.

Safety considerations must address flight crew evacuations, venting, or an emergency crew response by flight attendants if one or all of the flight deck crew become incapacitated. There have been situations where a flight attendant was able to pull an incapacitated pilot from the controls and allow the other pilot to fly the aircraft safely to the ground.

Recommendation 4: We recommend that a future design of the doors meet the requirements of rapid decompression, flight crew rescue and exit, and protection from intrusion caused by blunt force, ballistics, fragmentation, or other explosive effects. The new design should be required for new aircraft types. We recommend that as many elements of the new design as practical be retrofitted into the fleet.

Another strategy for controlling access on some aircraft in the longer term is a mantrap, which is a set of two doors that requires the person to enter the first while the second is closed. The person cannot pass through the second door until the first door is closed. This system provides security in at least three ways. It makes it difficult to forcibly gain entry by knocking down a single door, it allows time to evaluate the person in the mantrap before releasing him or her through the second door, and it allows entry of only one person at a time. This design will have limited applicability to most aircraft in the U.S. fleet because, for example, the passenger entry door is too close to the flight deck to accommodate this design.

Flight Deck Access

Recommendation 5: We recommend that these flight deck procedural changes be made at all airlines within 30 days.

With an immediate goal of adding barriers to the flight deck, we must address access to the flight deck and how it will be controlled. Since the events of September 11, airlines and their pilots and flight attendants have implemented their own procedures, which include:

· Prohibiting passengers from loitering at the forward lavatory and galley areas

· Leaving curtains/dividers open between cabins to allow for unobstructed views

· Strictly enforcing seatbelt signs

· Reinforcing crew coordination to facilitate immediate reporting of suspicious activities to other crewmembers

· Suspending pre-flight beverage service during the passenger boarding process to allow flight attendants to focus on passenger boarding

· Requiring the forward lavatory and the interphone to be operational for dispatch

· Positively identifying those entering the flight deck, using peepholes, codewords, or other similar methods

· Putting the jumpseat in the down position during flight if doing so inhibits access to the flight deck

With the flight deck no longer readily accessible to flight attendants, they must have a method for immediate notification to the flight deck during a suspected threat in the cabin. On receipt of such a warning, the pilot would check to make sure that the flight deck door is secure and begin immediate landing procedures. Consideration should be given to systems that might be installed in the aircraft as well as a device that could be carried by a crewmember. In those aircraft equipped with an automated evacuation alarm system, it may in the near term be an effective tool for such notification.

Recommendation 6: We recommend that industry develop a plan of feasible alternatives for emergency warnings within 30 days.

Under Security Directives already issued, airlines have restricted use of the jumpseats aboard their aircraft to their own pilots and flight engineers, and FAA inspectors. For the short term, these restrictions should be endorsed and continued. Qualified flight deck personnel in jumpseats provide safety and security benefits to the crew and passengers. The extra person assists the flight deck crew in many ways. That person is an extra set of eyes, ears, and hands, and may be able to take action for the crew while the crew flies the aircraft.

Some airlines have instituted additional screening of pilots from other airlines and are accommodating them by seating them in the passenger cabin on space-available basis. We agree that improved screening should be required until credential verification can be improved, consisting of identification check before boarding the aircraft and again after boarding the aircraft, by the flight crew. A simple question and answer technique is recommended. Additionally, jumpseat occupants should display conspicuously a picture identification at all times on the aircraft.

Recommendation 7: We recommend that airlines and pilots unions develop procedures that will allow gate and flight deck personnel to verify the credentials of a non-company pilot or flight engineer who asks to occupy a jumpseat within 6 months.

In the long-term automated or other systems should be considered to accomplish positive identification of all flight crewmembers before entering the aircraft.

Recommendation 8: We recommend FAA and industry define requirements for an automated system to validate, in real time, the identities of persons with legitimate access to the aircraft, within 6 months. (Universal access identification). Implementation will be based on those requirements, when defined.

There is consensus that cameras to monitor and view the area outside the flight deck door may add value. There should be continuous lighting outside the flight deck door for visibility, as well as to provide lighting for cameras. However, placement of a monitor in the limited space on the flight deck is a challenge. While there may be value in video or audio systems which provide information about activities throughout the cabin, we have no consensus on whether or how to proceed with this technology.

Recommendation 9: We recommend that industry evaluate the use of cameras and lighting outside the flight deck door within 6 months.

Defensive Capabilities in Cabin and Flight Deck Areas

Recommendation 10: We recommend industry work with the FAA to evaluate these factors and make recommendations for personal protection within 6 months. We recommend the implementation of defensive capabilities in accordance with the recommendations of the evaluation, within 1 year of receiving the recommendation.

We support the notion of crewmembers using non-lethal defensive capabilities in the cabin area and on the flight deck in hijack emergencies. This is a new approach to aircraft security, provoked by the attacks of September 11^th. Our proposed security strategy would require that the flight crew door remain locked during a suspected security threat, leaving flight attendants with the responsibility to address all cabin disturbances without the help of the flight deck crew. The crewmembers should have access to non-lethal devices and specific self-defense training.

In the case of non-lethal devices, there is consensus that the goal of such devices is to deter any terrorist plan, deny access to the flight deck, retain control in the cabin, or if necessary recover control on the flight deck. There is no clear consensus on what type or how many non-lethal devices should be placed on the aircraft or who should have access to such devices. However, ALPA recommends installation of stun guns on the flight deck. To reach consensus, the following factors must be evaluated:

· The appropriate type(s) of non-lethal defensive capabilities and the relative effectiveness of each

· Domestic and international rules and laws governing the use of non-lethal protective devices

· Training and qualifying for all crewmembers in the use of such devices

· Weapons control (in a sealed/locked compartment on board the aircraft) and strict accountability procedures

· Standard operating procedures to maintain control of the situation after the device has been used

· Recurring maintenance and inspection of the devices

· Preventing access to these devices by passengers

Recommendation 11: ALPA recommends the FBI present reasons for or against its proposal to arm pilots.

As to lethal weapons, the Air Line Pilots Association (ALPA) has taken a public position that a volunteer program be established with specific guidelines for arming pilots in flight. Other members of the task force have identified numerous issues requiring resolution before consideration is given to arming the pilots. These issues should be considered to determine whether they can be overcome.

Security Training and Delivering Information

Recommendation 12: We recommend industry, unions, and FAA redesign security training to address newly-identified threats within 30 days, incorporate changes into the annual curriculum within 60 days, and provide security training to all crewmembers within 6 months after updating the curriculum.

Security training is recognized as outdated in respect to today’s threats. Both initial and recurrent training programs must be rapidly modernized and delivered to all crewmembers reflecting current threat information. As a minimum, this new training should prepare crewmembers to identify and understand the different levels and types of threats to the safe passage of crew, passengers, and aircraft. Development of this training should use at a minimum the expertise of law enforcement organizations and professionals familiar with hijacking situations.

Recommendation 13: We recommend that each airline, in cooperation with the FAA or other Government entities, develop within 60 days a delivery system or procedure to provide Government security advisories to crewmembers in a timely manner, including immediate threat information to affected aircraft in flight.

A related issue is the delivery of relevant security information to crewmembers and other affected personnel in a timely manner. For international operations, there is a requirement that crew briefing include relevant security threat information. The same practice should be applied to U.S. domestic operations. We need a delivery system to permit crewmembers and other appropriate persons to receive the latest security advisories, as needed. Airline dispatchers must take on the responsibility to forward all immediate threat information to affected aircraft in flight. The system should take advantage of available technology for distribution of this information.

Cabin Search Procedures

Recommendation 14: We recommend the FAA provide more guidance on the conduct of cabin searches within 30 days. Airlines will continue to conduct the cabin search and to provide sufficient time and training for those personnel. No cabin search duties should be assigned to flight or cabin crew.

Recent security directives require cabin search procedures to minimize risk. Current procedures do not guarantee that those conducting cabin searches are trained adequately on best practices and use of the most recent technology. We are concerned that access to the aircraft between the time the cabin search is conducted and flight is not restrictive enough. We endorse the recently introduced FAA Security Directives requiring cabin search procedures. However, there is a need for additional training for those personnel conducting cabin searches.

Recommendation 15: We concur with the recommendation of the Airport Security Team to develop a new Federal security agency and we recommend that the new agency be responsible for conducting searches of aircraft cabins.

As a long-term option, we believe this task should be assigned to some sort of Federal security force. Creating such a force would avoid the need to assign additional responsibilities to current carrier personnel who may not be as familiar with dangerous items or who may be performing other duties under limited time constraints.

Transponders

Recommendation 16: We recommend the creation of an FAA-industry task force to determine the necessary modifications to assure continuous transmission of a hijack signal, even if the fight deck-selected code or function is turned off. Recommended action is to be defined within 30 days.

One lesson from the attacks of September 11^th is the importance of ensuring continuous transponder communication with air traffic control (ATC) following a hijacking. Without the transponder switch in a fully active position, ATC can track an aircraft only by primary radar, which does not indicate aircraft identity and altitude. The loss of this information causes other aircraft to lose awareness of the flight in progress.

While it is possible that a major redesign could be required, we have learned of possible modifications that could be accomplished more quickly. The task force should examine all alternatives that would allow the ability to set and lock-in the hijacking code so that the hijacker cannot disable it; a panic button that initiates the hijacking code in an emergency situation; and an independent transponder that cannot be disabled by the hijacker.

Aircraft Defensive Methods

Recommendation 17: We recommend that within 30 days, airlines, pilots, and the FAA should jointly identify procedures in pilot training, including depressurization and rapid descent, that could be adapted in an attempted hijacking to control a hijacker.

We have received many suggestions regarding the use of aircraft defensive maneuvers as a tactic to thwart a hijacking. After industry discussion, we feel that these tactics should be used only as a last resort. While we do not openly recommend it, we acknowledge that aircraft defensive maneuvering and aggressive use of cabin pressure systems may be beneficial under certain extreme situations. Since limits in aircraft performance and pilot capabilities may prohibit/preclude the use or limit the effectiveness of such methods, any proposals must be validated for effectiveness and trainability before implementation.