ICAO systems were totally compromised – Thomas Carter, US ambassador to ICAO

As a matter of fact, when the article broke, some in the Secretariat were more concerned about finding the leaker than giving the Council an accurate portrayal of what actually happened. If there’s a silver lining in this cloud, though, it’s become clear that we need to strengthen the Whistleblower Protection Program at ICAO and the Council has also made that a priority

• Wants ICAO whistle blowing policy strengthened
• ICAO working on reporting an aircraft in distress’ coordinates every minute by 2021
• I have more than a passing interest in B737 MAX

Admin l Wednesday, May 08, 2019

WASHINGTON – US ambassador to the International Civil Aviation Organisation(ICAO), Mr. Thomas Carter has said that ICAO’s network had been compromised for quite some time to such an extent that both member states and contractors had to fend off attacks from malware that emanated from the ICAO system.

“To put in bluntly, ICAO systems were totally exposed by a foreign state actor, and two completely independent forensic investigations proved this to be true. The way the hacks – by the way, not just one, but four – were handled was unacceptable”, Carter said in his remarks to the International Aviation Club in Washington.

According to him, earlier this year, a Canadian Broadcasting Corporation article appeared that included some appalling allegations regarding a November 2016 cyber hack of ICAO’s entire IT system, and its subsequent cover-up.

“ICAO’s corporate response was that the reports were “over exaggerated.” In fact, Council members have subsequently learned that ICAO’s network had been compromised for quite some time and that both member states and contractors had to fend off attacks from malware that emanated from the ICAO system.

“To put in bluntly, ICAO systems were totally exposed by a foreign state actor, and two completely independent forensic investigations proved this to be true. The way the hacks – by the way, not just one, but four – were handled was unacceptable”, he said.

Besides, Carter argued that Council recently expressed a significant lack of confidence in the existing IT system’s security and recommended concrete steps towards determining, once and for all, if there is still malware within ICAO’s domain, he said, adding that the lack of resolve on the part of the Secretariat to deal with the issue in a transparent way, and the effort to downplay the severity of the breach, was truly regrettable.

“As a matter of fact, when the article broke, some in the Secretariat were more concerned about finding the leaker than giving the Council an accurate portrayal of what actually happened. If there’s a silver lining in this cloud, though, it’s become clear that we need to strengthen the Whistleblower Protection Program at ICAO and the Council has also made that a priority.

“All of this of leads me to say something that I’ve yearned to say since all of this started, and that is “thanks for a free press.” We, as Council Representatives of our countries, would not have known about the inadequate response to the hacks or the immense harm that they inflicted on ICAO’s IT systems without the CBC article”, he said.

He explained that in November 2018, the GADSS, or Global Aeronautical Distress and Safety System, started requiring aircraft position reporting every 15 minutes, and it seems to be working well, adding that we have a target date of 2021 for systems that can report an aircraft in distress’ coordinates every minute, which will hopefully lead to a time when finding an aircraft’s location can be limited to a roughly six nautical mile radius.

On the B737 MAX, he said he is keeping tabs.

“I’m keeping tabs on the very methodical process that our FAA is pursuing to get the MAX back online and from my perspective, it’s clearly an international issue with implications for ICAO. I’m already been contacted by groups here in DC about reviewing ICAO standards but of course, we’ll wait until we get both accident investigation reports to determine exactly what changes may be needed. Having three thousand hours and a type rating in the B737 myself, I can assure you that I have more than a passing interest in this subject”, he said.