Cyberfit to Fly: Lessons from the Chris Roberts Case

Modern aircraft depend on complex digital systems. In addition to engines, hydraulics, and avionics, there is now an extensive network of interconnected software, hardware, and communication pathways. Ensuring the security of these systems is essential to maintaining safety, reliability, and continuing airworthiness.

In 2015, cybersecurity researcher Chris Roberts reported to the FBI that he had accessed in-flight entertainment (IFE) systems on commercial aircraft. According to media summaries of FBI filings, Roberts claimed to have connected his laptop to the Seat Electronic Box (SEB) beneath passenger seats, accessing the IFE network. In one instance, he stated that he could issue a “CLB” (climb) command to the Thrust Management Computer (TMC), which he claimed caused one engine to climb and resulted in lateral movement of the aircraft. These actions were reportedly performed 15 to 20 times between 2011 and 2014. Roberts emphasized that his intent was to identify vulnerabilities rather than to endanger flight safety.

Following these claims, Roberts was removed from a United Airlines flight in Syracuse, New York, after posting publicly about his activities. The FBI seized his devices, including a MacBook, iPad, and USB drives. United Airlines banned him from future flights. The full FBI affidavit is not publicly available; media reports serve as the primary reference for the case.

From a cybersecurity perspective, the Roberts case highlights several key considerations:

Network Segmentation

Modern commercial aircraft are designed with strict isolation between passenger networks and avionics systems. One-way communication and firewalls prevent unauthorized access to flight-critical systems. While Roberts’ claims suggest potential vulnerabilities, expert analysis indicates that direct control of aircraft systems via the IFE network is technically unlikely.

Airborne Software Integrity

Aircraft software must maintain integrity, authenticity, and confidentiality throughout its lifecycle. Access points such as maintenance ports, cabin panels, and diagnostic interfaces must be controlled to prevent unauthorized changes or malicious software installation.

Ground Systems and Interfaces

Ground Support Equipment (GSE) and Ground Support Information Systems (GSIS) interact with aircraft digital systems during maintenance and operations. Devices and networks must be protected against cyber threats to prevent inadvertent introduction of vulnerabilities into airborne systems.

Regulatory Context

EASA Part-IS requires aviation organizations, such as air operators, maintenance providers, CAMOs, and others, to establish and maintain an Information Security Management System (ISMS) that addresses information security risks relevant to aviation safety. The FAA provides cybersecurity guidance through airworthiness documentation such as AC 119-1A: Operational Authorization of Aircraft Network Security Program (ANSP), which outlines acceptable means for obtaining operational authorization for an aircraft certificated with a special condition (SC) related to the security of the onboard computer network.

Both regulatory frameworks reference industry standards like EUROCAE ED-204 / RTCA DO-355 for aircraft-specific cybersecurity risk management, detailing the operational and maintenance activities required to address information security threats throughout the aircraft lifecycle.

Responsible Disclosure and Ethical Considerations

The case also emphasizes the role of ethical cybersecurity research. Identifying vulnerabilities is critical, but proper coordination with regulators and manufacturers is necessary to prevent safety risks.

In conclusion, the 2015 Chris Roberts case provides a practical example for aviation cybersecurity. While his claims remain partially disputed regarding technical feasibility, the incident highlights the necessity of proactive cybersecurity measures, rigorous monitoring, and a coordinated approach across airborne software, networks, and ground systems.

Stay tuned for our next articles, where we will dive deeper into the Aircraft Information Security Ecosystem, strategies for managing airborne software, and the implementation of the Aircraft Information Security Program, essential for protecting aircraft systems and maintaining continuing airworthiness.

Take the Lead in Aircraft Cybersecurity

Apply the lessons from the Chris Roberts case to real-world operations.
Join our Information Security for Continuing Airworthiness course and learn to secure airborne software, networks, and ground systems, aligned with EASA Part-IS and EUROCAE ED-204 / RTCA DO-355 standards.