I think that my office is too soft with cybersecurity. If someone really wanted to, I think they could obtain sensitive information easily by tricking unaware employees or through unprotected company networks.
Respondent, McAfee Online Ethnographic Study
As I begin writing this chapter, I do so from the most unnatural of places that has become strangely familiar to me—roughly 35,000 feet above the earth’s surface in a tube weighing more than 50 tons and traveling nearly 450 miles per hour. I’m en route from Tampa to Dallas after a long weekend of visiting family. Travel for me has become ordinary. I’m not one to consider myself a road warrior by most definitions of the phrase, but I still easily log more than 100,000 miles in a year—worthy enough to earn elite traveler status from my preferred airline to make the routine a bit more bearable.
Even though I’m struck by just how mundane travel has become in my life, I still consider myself a bit of a nervous traveler. For instance, leading up to a trip, I fixate on what I’ll pack for the visit (whatever it is and for however long the trip, it must fit in an airline-approved carry-on suitcase, since checking baggage is simply out of the question). On the day of travel, I check for my identification, wallet, and cell phone several times before I leave for the airport. (I have a healthy dose of anxiety that I’ll arrive at the security checkpoint only to find I’ve left one of these essentials behind.) I give myself plenty of time to make it to the airport since sprinting through a terminal, breathlessly dragging myself and my carry-on luggage through crowds of fellow passengers to make my flight just in time is simply not my idea of a good time. Then, when I do get to my gate, I wonder if the flight will be on schedule given I’m usually rushing to a meeting as soon as I’m supposed to arrive.
These thoughts are like a perennial playlist of worrisome possibilities I set to repeat in my brain every time I travel. But notice what track isn’t on the list. For all my fretting, there’s one concern conspicuous by its absence. That is, I don’t worry about my safety. I don’t actively think about whether getting in a 50-plus ton tube hurling itself roughly seven miles above the earth is a good idea. I assume that it is. And I join the ranks of four billion passengers worldwide who do the same each year.1
How far I’ve come from my very first flight. I was a 20-year-old intern with INROADS, a nonprofit organization that gave me my start in Corporate America. I was on my way from Tampa to Atlanta for a special INROADS retreat with my friends and fellow interns. I boarded the plane and took my seat way in the back—next to the lavatories, which I thought was great luck since I’d be extra close to the restroom should nature call. How convenient!
As the flight attendants were giving safety instructions that my ears were hearing for the first time, I dutifully began to comply with buckling my seatbelt. Only it didn’t buckle. After a few failed attempts and asking the passenger next to me for assistance, it was clear: My seatbelt was broken. I remember thinking to myself, Oh well. I guess seatbelts are sort of optional, kind of like they are on a school bus. I didn’t think twice to mention it. And the flight attendants didn’t look twice to confirm I had securely fastened it.
Of course, after logging millions of miles in the air, I know how egregious a broken seatbelt is. Today, I wouldn’t consider taxiing the runway, let alone leaving the ground, without a properly fitting belt secured firmly about my waist. (As an aside, that airline I took on my maiden voyage eventually went out of business. At the heart of its ultimate derailment? Serious safety concerns.)
I now know what safety looks and feels like on a plane and in an airport. And I’m well aware of the behemoth infrastructure that assures me one primary right as a passenger: a safe experience. That’s not to say that airplanes don’t crash. But, at the same time, I needn’t settle for anything less than a safety standard rigorously upheld in air travel—and, yes, an effective seatbelt certainly qualifies on the list.
There’s a reason that air travel remains the safest mode of transportation—more than 100 times safer than the automobile.2 There’s a culture of security that permeates every facet of the airline industry.
That statement may not strike you as extraordinary. You might think that safety should be at the heart of air travel. After all, the industry exists to transport precious cargo—in this case, human lives—from one place to another. You’d only be partially right. In fact, the commonplace nature of security that has become so threaded into the very fabric of air travel belies its virtually nonexistent beginnings in the industry.
When we think of the good ol’ days of flight, our minds conjure up images of fashionably attired passengers, doted on by service-conscious flight attendants, on luxury liners with legroom to spare and haute cuisine served in the friendly skies. What that nostalgic image lacks is any reality to the dangers of flying back in those days. Passengers suffered a fatality rate nearly four times today’s average3 given a “culture of security” that was anything but. Consider this punch list of safety concerns passengers faced at one time or another during the history of commercial airline travel:
Those are just 20 examples of how far the safety of air travel has come through the decades. And I haven’t even scratched the surface of all the changes made in a post-9/11 world that forever altered the complexion of commercial flight.
These changes didn’t happen overnight. They are the result of an industry, under siege by adversaries (environmental and human alike), pressured to steadily raise the bar on security over time. While we may be nostalgic for simpler times, when airport security was virtually nonexistent, many of us will also never know the terror that once threatened the freedom of flight. If you’re like me, you can’t imagine boarding a flight with a perpetual fear that it could be diverted or doomed, not by turbulence or inclement weather, but by a hijacker bent on personal or political gain.
Yet, that image—which has become the fare of big box-office action movies—was once a sobering reality for travelers during what has been dubbed the Golden Age of Hijacking. Skyjackers commandeered over 130 planes in American airspace between 1968 and 1972, often at a pace of one or more per week.6 The hijacking “virus” was a raging epidemic. Media covered this dark reality of air travel with equal fervor. As psychiatrists interviewed hijackers, they discovered a mentality of one-upmanship. Would-be skyjackers, enamored with widespread news coverage of the latest airplane seizure, would think to themselves, “I can do better than that; I can improve upon that.”7 So the contagion spread.
It’s hard to believe, but hijacking became such a common occurrence during those years that passengers simply accepted it as part of the air travel experience. In 1968, Time somewhat poked fun at the hijacking plague with an article aptly titled, “What to Do When the Hijacker Comes.” In it, the journalist reports of more than 1,000 Americans diverted to Cuba over the previous eleven months. While “pilots carry maps of Havana’s Jose Marti Airport just in case, and stewardesses are instructed not to argue with would-be hijackers—simply to obey their orders . . . nobody has yet thought to brief the poor passengers.”8
The author graciously obliges with some dos and don’ts should one find herself an unwitting passenger on a hijacked plane—like don’t be aggressive, don’t panic, don’t push the call button (lest the ding startle the hijacker causing him to unintentionally discharge his weapon), and don’t call aloud for the “stewardess.” When the flight arrives in Cuba, the journalist suggests two dos: Do stay calm and do enjoy the stay (the article even offers some helpful details on comfortable overnight accommodations in the area).
How did airlines handle the persistent threat? They complied with the hijackers. If a skyjacker wanted to land in Cuba (or anywhere else), pilots would divert the flight. All cockpits were equipped with maps of the Caribbean Sea, regardless of a flight’s intended destination, given the popularity of Cuba as a hijacking destination at the time. Further, pilots were given popular phrase cards in Spanish to help them communicate with Cuba-bound skyjackers (such as learning how to say “I must open my flight bag for maps” or “Aircraft has mechanical problems—can’t make Cuba”).9 If the perpetrator wanted money, airlines would pay the ransom and hope for its return upon the subject’s arrest. Airlines fought tenaciously to protect their existing lax security controls, outright resisting deterrents like metal detectors that would thwart skyjackers since they didn’t want to subject their paying guests to the same scrutiny.
Unbelievably, airlines so refused the concept of imposing security restrictions that they even considered building a fake airport in southern Florida resembling Cuba’s own as an alternative to metal detectors and the like. Under this proposal, pilots would land at the decoyed airport, where federal agents would await the suspect’s arrival.
Due to cost, the fake airport idea was jettisoned in favor of behavioral profiling instead. Ticket agents would give passengers a once-over for any one of roughly 20 possible behavioral warning flags of a potential hijacker in disguise. To put passenger convenience above security, the profiling would apply to less than 1 percent of all travelers, leaving more than 99 percent unencumbered.
Airlines didn’t readily embrace the culture of security I credit them with today. In fact, they accepted these human adversaries in their environment and developed practices to work with them. The security controls now all too common did not initially conform to the airline industry’s paradigm of an optimal customer experience. At the time, the rationale for complying with terrorists rather than securing the airways seemed sound. It was the first time that air travel had moved from the elite upper crust to the mass-market traveler. Security delays that cost travelers as little as 15 minutes in extra time could be sufficient incentive to stimulate alternate modes of transportation. It was a risk the relatively fledgling industry couldn’t afford to take.
Until November 10, 1972, when hijacking moved from the realm of minor inconvenience to that of national threat. Three hijackers threatened to crash a plane into an atomic reactor at Oak Ridge National Laboratory in Tennessee. The Federal Aviation Administration (FAA) took the measure that airlines had abdicated. In January of the following year, all passengers would undergo physical screenings, including passing through metal detectors and having their bags searched.
Adversaries are nothing if not determined and innovative. When hijacking proved more difficult thanks to the imposed airport screening, perpetrators turned their attention to aircraft bombs. When security measures were improved in the 1990s to defend against that threat vector, terrorists topped themselves on September 11, 2001, carrying on permissible box cutters to commandeer and use commercial airliners as self-guided missiles (reminiscent of that failed hijacking in 1972 threatening the same).
At every turn, the airline industry has responded with additional security measures.
This cat-and-mouse game will persist. When the next threat emerges, the airline industry will respond with security controls designed to inoculate it. While passengers may grumble at the inconvenience, they’ll also accept a new normal that is, at its heart, designed with security at its core.
It’s the reason I point to the airline industry as the poster child for executing a culture of security. That’s not to say airlines willingly abided by all the controls that keep us safer, if not somewhat inconvenienced, today. There was plenty of resistance in the earliest days when the industry and its passengers viewed hijacking as a nuisance, not a threat.
But consider the following list as a subset of what must happen today before an airplane is cleared for takeoff. Should any of these items be lacking, passengers can expect a delay, if not cancellation of the flight:
These safety checks, including security screenings, can be even more extensive for international flights arriving in the United States.
Critics will be quick to point to the shortcomings of these security assessments in safeguarding passengers. They will highlight the TSA’s failure rate in its own penetration tests, where at least 70 percent of illegal contraband slipped through its cracks in 2017.10 Indeed, no security posture is perfect, and the airline industry is no exception to the rule.
Instead of criticizing, let’s consider the track record. More specifically, let’s look at the critical outcome that many would likely agree is most important—the safe transport of passengers. On this metric, the airline industry has performed quite well indeed.
In 2018, the Aviation Safety Network reported a fatal accident rate for large commercial flights at .36 per million flights. That equates to one fatal accident for every three million flights.11
Some countries, like the United States, saw an even lower fatality rate. From 2009–2018, U.S.-operated airlines flew several billion people on almost 100 million flights, with no fatalities.12
These results speak for themselves. They give me confidence as a frequent traveler that I’m much more likely to die of cardiovascular disease, in a car accident, from a lightning strike, or even a bee sting,13 than I am to surrender my life on an airplane. I may have worries about packing the wrong items or leaving my identification at home, but I don’t fret about my safety. That’s because I know the airline industry is ensconced in security. The public and private sector have united with one goal in mind: keeping travelers safe.
Perhaps your company isn’t in the business of preserving lives. Or perhaps your industry hasn’t yet seen its equivalent “Golden Age of Hijacking.” Maybe your company hasn’t yet experienced its metaphorical 9/11. I’m hoping that it doesn’t need to in order for you and every other employee and board member to put security in its proper place.
Will these prescriptions spare your company from ever suffering a breach? Certainly not. But will they deliver positive outcomes that allow your company to mitigate risk and recover from attacks more effectively? Absolutely.
For all my praise of the airline industry’s track record, even it is not immune from a threat-free existence—human or otherwise. Just days before my brief hometown visit to Tampa, there was devastating news of an Ethiopian Airlines crash that killed all 157 on board. My mom is not a frequent traveler. She is, however, a frequent watcher of cable news networks. She called me in the days leading up to my trip.
“Allie, I’m worried about your trip out here. What type of aircraft are you on?”
“Mom, I don’t know. What are you watching and why are you asking?”
“There’s a report that the Ethiopian Airlines crash looks similar to another one from a few months ago. They were both on a 737 MAX plane. Is that your plane?”
“Mom, please stop watching the news. I’m fine. I’m much more likely to die in a car accident than an airplane.” (More blah, blah, blah on airline safety records, much of which didn’t penetrate my mother’s extraordinary defenses against hearing anything that would alleviate her fears.)
“Babe, I just need to know if you’re on one of those jets. If so, let’s reschedule.”
Turns out I didn’t need to reschedule. And I also didn’t need to check the aircraft of my flight. The day before my scheduled departure, the FAA grounded all Boeing 737 MAX 8 planes. That culture of security that envelops every facet of an airline industry I use regularly once again put my safety first.
While I may not have second-guessed the potential danger, the FAA’s actions weren’t lost on my mom. The night before my flight, she called me to confirm my arrival details.
“Allie, I’m so glad we didn’t need to reschedule your flight. Thank God they grounded all those airplanes.”
“Yes, Mom. Thank God, indeed.”
And, thank the airline industry for showing us what a culture of security can be—definitely not perfect but certainly strong enough to deter formidable adversaries and allay the concerns of even the most paranoid among us. Including my loving mom.