News

The FAA is proposing updates to enhance cybersecurity standards for aircraft, engines, and propellers. But why are these changes necessary?

Aircraft avionics have been advancing for quite some time, offering pilots valuable information and enabling engineers to quickly access and diagnose aircraft systems. However, with these innovations comes increased interconnectivity among various devices, raising the potential for cybersecurity threats. The FAA and industry experts refer to these as Intentional Unauthorized Electronic Interaction (IUEI), which is defined as:

A situation or event that could impact the aircraft due to unauthorized human action, leading to access, use, disclosure, denial, disruption, modification, or destruction of information and/or aircraft system interfaces. This includes malware and effects from external systems, but excludes physical attacks like electromagnetic jamming.

These new regulations apply not only to airliners but also to larger aircraft that can carry 19 passengers or have a maximum takeoff weight (MTOW) of 19,000 lbs (~8.6 tonnes), though they don't affect smaller aircraft like the Cessna 172. Photo: ATP/Textron Aviation

Modern pilots often use Electronic Flight Bags (EFBs)—essentially tablets with checklists, performance calculators, maps, and possibly other company-specific software. In many instances, these devices don’t directly interface with aircraft systems. However, newer aircraft frequently allow pilots to transfer a flight plan from an iPad to the aircraft’s flight management computer. Similarly, airline engineers can connect to aircraft systems using tablets or laptops through wired or wireless connections. System software updates are also commonly done via USBs or memory cards.

The FAA now seeks to amend regulations to address cybersecurity vulnerabilities stemming from these and other sources, including:

• Field Loadable Software

• Maintenance laptops

• Airport or airline gate link networks

• Public networks, like the Internet

• Wireless aircraft sensors and sensor networks

• Cellular networks

• USB devices

• Satellite communications

• Portable electronic devices and EFBs

• GPS and satellite-based augmentation system digital data

Although the FAA already has airworthiness regulations addressing cybersecurity threats in aircraft, the agency believes the current regulations don't sufficiently cover the new ways aircraft and systems communicate.

Fortunately, many of these new systems are secure, thanks to special conditions issued by the FAA and other global regulators during the certification process to address emerging cybersecurity threats.

The proposed regulations aim to standardize these special conditions, potentially simplifying the certification process for aircraft and their components. The FAA is accepting comments on these proposed IUEI regulations until October 21st of this year.

Boeing just can't seem to catch a break. Only weeks after beginning 777-9 certification flights with the FAA, a new issue has grounded its entire test fleet.

The American aircraft manufacturer is currently using three 777-9s for certification testing. According to The Air Current, Boeing engineers first identified a problem on one of the 777-9s during routine maintenance. The situation worsened when the same issue was found on another 777-9. The initial discovery occurred on an aircraft that had just landed in Hawaii, and with the grounding of the test fleet, that jet is now stuck there.

The problematic component is a thrust link, of which each aircraft engine has two for redundancy in case one fails. The 777X family is equipped with General Electric GE9X engines. However, The Air Current, which first reported the issue, notes that Boeing manufactures this specific part—not GE. Similar thrust link designs are used in other Boeing aircraft as well.

Boeing is currently working to certify three aircraft: the 777-9, the 737 MAX-7, and the MAX-10. Two other versions of the 777X, the 777-8 and the 777-8F, are slated for certification at a later date. The certification of the two 737 models is currently on hold as Boeing redesigns components related to the engine cowling and anti-ice system.

This latest issue with the 777-9 engine mounting has stalled some of the progress Boeing recently made with its next-generation widebody aircraft. FAA pilots began certification flights just over a month ago. However, previous engine issues, structural test failures, and system problems have already delayed the 777X's certification by more than five years.

Most analysts now expect the 777-9 to begin carrying passengers in 2026, meaning the 777X's development will span over 13 years from launch to service entry. This is remarkably long, especially considering the 777X is theoretically a redesign of an existing aircraft. To put it in perspective, the original Boeing 777 was launched in October 1990 and entered service in June 1995—taking less than five years from launch to service!