Tesla to Wind Down Cybertruck Production
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Read more of this story at Slashdot.
Beginning next month, if a flight is canceled or delayed because of a cyberattack, feds will give airlines clearance not to hand out meal vouchers or hotels.
The change is the result of a broader rule the Transportation Department published last week that establishes a new βcause of delayβ category for tracking information, but that also reduces air carrier responsibilities to customers for 10 kinds of events. Among them: βcybersecurity attacks (provided that the air carrier is in compliance with applicable cybersecurity regulations).β
The 10 events, including those cyberattacks, are deemed βnot controllable,β meaning that βcarriers are no longer obligated under [customer service] plans to provide amenities or compensation when disruptions arise from these specific causes,β as Sophie Hayashi, counsel at Crowell & Moring in the transportation group, wrote in a client alert.
Those airline-authored customer service plans arenβt legally binding, although DOT has maintained it will hold airlines βaccountableβ for their pledges.
One airline consumer advocacy organization, FlyersRights, was skeptical of the change, saying it came without giving the public a chance to comment and that it would be monitoring the impact on airline customers and tracking any reduction in amenities.Β
Specifically, βcybersecurity is an airline responsibility, so if a flight is delayed or cancelled it should be clear that the delay was not due to carrier neglect, as cyberattacks are constant,β Paul Hudson, president of the group, told CyberScoop. βWe have previously urged stress tests for airline computer systems that are going down often.β
Another group, the National Consumers League, had a more mixed view about the ruleβs effects on flyers. On one hand, it could be good for them, said John Breyault, vice president of public policy for the group.
βWhat we appreciated about this being put into a rule was that it gave consumers certainty that regardless of which airline they were flying, they would know that they have certain rights, and they werenβt beholden to the whims of the airlines who may or may not decide to provide them with a hotel if thereβs a delay or cancelation,β he said.
On the other, though, βitβs clear to us that the DOT seems inclined to try and make the rules a little less onerous for the for the airline industry,β Breyault said, and in particular was worried about how airlines could potentially abuse the ambiguity related to one of the 10 events, βunscheduled maintenance,β to find a way to avoid compensating consumers.
The provision might still protect consumers because of its condition on compliance with applicable cybersecurity regulations, Breyault said. Carriers who canβt demonstrate compliance will be subject to customer and other requirements, Hayashi said.
βThe final ruleβs language regarding applicable cybersecurity regulations is notably broad,β said Kate Growley, partner at Crowell & Moring. βThis may have been deliberate to account for the unpredictable nature of cybersecurity attacks. Different regulations may apply depending on the exact circumstances of the attack, such as what information or operational capabilities were affected.β
Thereβs no formal accounting of how often cyberattacks have caused delays or cancellations that then prompted airlines to provide meal vouchers or hotels. Hackers have targeted airlines and flights before, such as Scattered Spiderβs attacks last summer.
Cyberattacks have caused flying delays and cancellations, although sometimes those attacks have been aimed at third parties, such as in last yearβs attack on Collins Aerospace led to delays in Europe. Attackers also have targeted other elements of the aviation sector. The 2024 IT outage related to the cybersecurity company CrowdStrike that grounded flights wasnβt a cyberattack, but did lead to airlines providing some compensation to travelers; the Transportation Department determined that incident was within airlinesβ control.
The Biden administration notably imposed cybersecurity regulations on airports, aircraft owners and aircraft operators in 2023 due to βpersistent cybersecurity threatsβ in the sector.Β
The newly-published Department of Transportation (DOT) rule stems from a Federal Aviation Administration authorization law that President Joe Biden signed in 2024.Β
βCongress explicitly directed DOT in the FAA Reauthorization Act of 2024 to make these changes,β a Department of Transportation spokesperson said. βThese 10 specific types of flight disruptions will now β¦ be tracked in a brand-new reporting category to ensure government delay data accurately reflects what airlines can and cannot control.β
The Aviation Information Sharing Analysis Center said it appreciated the elements of the rule related to reporting incidents.
βThe Aviation ISAC supports efforts to simplify and harmonize cybersecurity reporting across numerous government agencies,β said Jeff Troy, president and CEO of the organization. βThis rule is a move in the right direction.β
Hayashi told CyberScoop the rule change looks to be positive for both airlines β because of the clarity it provides them about disruptions not under their control β and consumers.
βThis actually is beneficial for everyone, and particularly consumers, because it makes it clear if youβre looking at airlines delay and cancellation rates, this is going to give you the most accurate picture of carrier delays,β she said.
The post Cyberattack causes a flight delay? Airlines wonβt owe you a hotel or meal appeared first on CyberScoop.