washingtonpost.com

1. Introduction

The threat to aviation safety has changed, and so must our response. The events of September 11 changed forever our concepts of appropriate aviation safety. The use of a hijacked aircraft as a weapon requires a new strategy to ensure that the crew always retains control of the aircraft.

In addition, the catastrophic destruction of lives and property has temporarily paralyzed America's will to continue flying. This is contributing to the disaster's adverse economic effects on the nation.

To combat the new threat and restore public confidence in commercial aviation, this report documents our consideration of changes to aircraft design and operation. Recommendations are highlighted throughout the report. At Appendix A is an abbreviated table of immediate, short-term and long-term recommendations for all aspects considered. The time periods in our recommendations are "Immediate" meaning within 30 calendar days; "short-term" meaning up to 6 months; and "long-term" meaning 1 year or longer. At Appendix B you will find Options papers featuring the greater details of each aspect considered. Appendix C includes unsolicited industry proposals. Appendix D is a digest of ideas, comments, and suggestions from concerned private citizens and from industry.

2. Personnel and Organizations Involved

The Secretary of Transportation quickly established a Rapid Response Team to identify specific measures to improve aircraft security. The Rapid Response Team for Aircraft Security considered onboard countermeasures against hijacking, including actions to recover control in the event of a flight deck breach by hijackers.

Rapid Response Team members include Robert W. Baker, vice chairman of American Airlines, Robert Davis, former vice president of Engineering and Technology for The Boeing Company, Patricia Friend, president of the Association of Flight Attendants (AFA), and Captain Duane Woerth, president of the Air Line Pilots Association (ALPA). We were supported by staff from the Department of Transportation's Office of the Secretary and Federal Aviation Administration.

We hosted an industry meeting attended by representatives from the Air Transport Association, the Southwest Airline Pilots Association, the Federal Express Pilots Association, the Allied Pilots Association, the Association of Professional Flight Attendants, the Regional Airline Association, Airbus Industries, and others. Before our meeting, ALPA had initiated a series of telephone conference calls with many of these same participants. That work resulted in a jointly submitted formal report entitled "Security Issues Related to Flight Standards and Certification" (September 25, 2001). In addition, The Boeing Company hosted several meetings of technical experts. In addition several airlines and other manufacturers have provided information for our consideration. Finally, we have received and considered hundreds of recommendations from the public.

3. Defining Concepts

We began our work developing options to address newly identified risks to aircraft security. Augmented by the suggestions and recommendations received from all sources, we evaluated all approaches based on whether they supported one or more of the following goals:

To DETER the hijack plan, making it too difficult, expensive or undesirable to use aviation as weapon of terror;

To DENY access to the flight deck by any threat;

To DELAY access to the flight deck, allowing the crew time to take protective measures; and

To RECOVER CONTROL through aggressive crew response.

We have included all of the options considered at Appendix B although there are some options we do not recommend.

4. Flight Deck Door Design

The multiple attacks of September 11, 2001, require that changes be made to the flight deck door that will deny access to an intruder. The safety requirements related to rapid decompression and emergency access, however, must be considered. Flight deck doors on U.S. airline aircraft were designed principally to ensure privacy, so that pilots could focus on their normal duties, uninterrupted by activity in the passenger cabin. Doors were not designed to meet significant security threats such as small arms fire or shrapnel, or the use of blunt force to enter the flight deck.

The prevention of unauthorized access can be improved by the simple addition and use of a deadbolt, a cross-bar, a net or other barrier devices. Our discussions and consultations with other aviation experts indicate that this installation on any individual aircraft can typically be accomplished overnight.

We recommend that some appropriate barrier device be approved, and installation begin within 30 days. Installation throughout the entire U.S. fleet should be completed in 90 days. We recommend that FAA enable the installation of these devices through urgent regulatory action that provides the airlines with a simple, expedited method for approval and installation.

Besides affording an orderly work environment for the flight crew, flight deck doors have other important safety characteristics. Current design standards require that the door must not hinder emergency exit from the flight deck or impede rescue efforts into the flight deck after an accident.

Current doors are designed to ensure that rapid decompression does not cause a failure which could have catastrophic effects on the aircraft. Such a failure is theoretically possible in such an event, if the pressure cannot be equalized between the flight deck and the cabin in an expeditious manner. Preliminary research indicates that a rapid decompression on the flight deck side of the door has a low historical occurrence. This research has revealed no accidents caused by a rapid decompression in the flight deck. This may be because the decompressions have not been rapid enough or the venting method worked as designed.

The addition of a deadbolt or another barrier may hinder crew exit, rescue, and the venting that the door's original design provided. Given the newly identified security risks, we recommend the FAA allow the use of a deadbolt or other barrier device, in the short-term, until the impact of these devices on decompression and rescue/exit can be determined and an alternative approach is designed.

We recommend that the industry identify and address the risks regarding rapid decompression and exit and rescue associated with the barrier devices that have been installed. Within 6 months, steps should be taken to accomplish the following:
(1) Approve a door design to ensure:
adequate venting of a closed and locked flight deck door in the event of a rapid depressurization in the flight deck area. Venting may involve provision of either a venting means or release of the door locking mechanism,
in the event of an emergency, exit and rescue of the flight crew, and
barrier against intrusion.
(2) Provide a barrier against access by an intruder through the venting feature of those flight deck doors having vents.
Within 1 year from approval of the door design, conduct a retrofit of the entire U.S. fleet of aircraft.

There may be more permanent and effective solutions that require longer time for implementation. The current flight deck door and associated bulkhead are not designed to minimize or mitigate the negative impacts from breaches caused by blunt force, ballistics, fragmentation, or other explosive effects.

Strengthening of the flight deck door can be divided into the following areas: (1) Improved locking, hinge, door handle, and door frame integrity; and (2) Using specialized materials to mitigate the catastrophic effects from ballistic, fragmentation, and explosives devices attacks. A design and performance specification with specific design requirements must be developed and approved which would include identification of the amount of load(s) the door and bulkhead must sustain from an attack and take into account the force that can be expected in an explosive decompression.

We recommend that ongoing work in the Aviation Rulemaking Advisory Committee Design for Security Harmonization Working Group be completed within 60 days, with respect to door design standards.

Safety considerations must address flight crew evacuations, venting, or an emergency crew response by flight attendants if one or all of the flight deck crew become incapacitated. There have been situations where a flight attendant was able to pull an incapacitated pilot from the controls and allow the other pilot to fly the aircraft safely to the ground.

Another strategy for controlling access on some aircraft in the longer term is a mantrap, which is a set of two doors that requires the person to enter the first while the second is closed. The person cannot pass through the second door until the first door is closed. This system provides security in at least three ways. It makes it difficult to forcibly gain entry by knocking down a single door, it allows time to evaluate the person in the mantrap before releasing him or her through the second door, and it allows entry of only one person at a time. This design will have limited applicability to most aircraft in the U.S. fleet because, for example, the passenger entry door is too close to the flight deck to accommodate this design.

We recommend that a future design of the doors meet the requirements of rapid decompression, flight crew rescue and exit, and protection from intrusion caused by blunt force, ballistics, fragmentation, or other explosive effects. The new design should be required for new aircraft types. We recommend that as many elements of the new design as practical be retrofitted into the fleet.

5. Flight Deck Access

With an immediate goal of adding barriers to the flight deck, we must address access to the flight deck and how it will be controlled. Since the events of September 11, airlines and their pilots and flight attendants have implemented their own procedures, which include:

Prohibiting passengers from loitering at the forward lavatory and galley areas

Leaving curtains/dividers open between cabins to allow for unobstructed views

Strictly enforcing seatbelt signs

Reinforcing crew coordination to facilitate immediate reporting of suspicious activities to other crewmembers

Suspending pre-flight beverage service during the passenger boarding process to allow flight attendants to focus on passenger boarding

Requiring the forward lavatory and the interphone to be operational for dispatch

Positively identifying those entering the flight deck, using peepholes, codewords, or other similar methods

Putting the jumpseat in the down position during flight if doing so inhibits access to the flight deck

We recommend that these procedural changes be made at all airlines within 30 days.

With the flight deck no longer readily accessible to flight attendants, they must have a method for immediate notification to the flight deck during a suspected threat in the cabin. On receipt of such a warning, the pilot would check to make sure that the flight deck door is secure and begin immediate landing procedures. Consideration should be given to systems that might be installed in the aircraft as well as a device that could be carried by a crewmember. In those aircraft equipped with an automated evacuation alarm system, it may in the near term be an effective tool for such notification.

We recommend that industry develop a plan of feasible alternatives for emergency warnings within 30 days.

Under Security Directives already issued, airlines have restricted use of the jumpseats aboard their aircraft to their own pilots and flight engineers, and FAA inspectors. For the short term, these restrictions should be endorsed and continued. Qualified flight deck personnel in jumpseats provide safety and security benefits to the crew and passengers. The extra person assists the flight deck crew in many ways. That person is an extra set of eyes, ears, and hands, and may be able to take action for the crew while the crew flies the aircraft.

Some airlines have instituted additional screening of pilots from other airlines and are accommodating them by seating them in the passenger cabin on space-available basis. We agree that improved screening should be required until credential verification can be improved, consisting of identification check before boarding the aircraft and again after boarding the aircraft, by the flight crew. A simple question and answer technique is recommended. Additionally, jumpseat occupants should display conspicuously a picture identification at all times on the aircraft.

We recommend that airlines and pilots unions develop procedures that will allow gate and flight deck personnel to verify the credentials of a non-company pilot or flight engineer who asks to occupy a jumpseat within 6 months.

In the long-term automated or other systems should be considered to accomplish positive identification of all flight crewmembers before entering the aircraft.

We recommend FAA and industry define requirements for an automated system to validate, in real time, the identities of persons with legitimate access to the aircraft, within 6 months. (Universal access identification). Implementation will be based on those requirements, when defined.

There is consensus that cameras to monitor and view the area outside the flight deck door may add value. There should be continuous lighting outside the flight deck door for visibility, as well as to provide lighting for cameras. However, placement of a monitor in the limited space on the flight deck is a challenge. While there may be value in video or audio systems which provide information about activities throughout the cabin, we have no consensus on whether or how to proceed with this technology.

We recommend that industry evaluate the use of cameras and lighting outside the flight deck door within 6 months.

6. Defensive Capabilities in Cabin and Flight Deck Areas

We support the notion of crewmembers using non-lethal defensive capabilities in the cabin area and on the flight deck in hijack emergencies. This is a new approach to aircraft security, provoked by the attacks of September 11th. Our proposed security strategy would require that the flight crew door remain locked during a suspected security threat, leaving flight attendants with the responsibility to address all cabin disturbances without the help of the flight deck crew. The crewmembers should have access to non-lethal devices and specific self-defense training.

In the case of non-lethal devices, there is consensus that the goal of such devices is to deter any terrorist plan, deny access to the flight deck, retain control in the cabin, or if necessary recover control on the flight deck. There is no clear consensus on what type or how many non-lethal devices should be placed on the aircraft or who should have access to such devices. However, ALPA recommends installation of stun guns on the flight deck. To reach consensus, the following factors must be evaluated:

The appropriate type(s) of non-lethal defensive capabilities and the relative effectiveness of each

Domestic and international rules and laws governing the use of non-lethal protective devices

Training and qualifying for all crewmembers in the use of such devices

Weapons control (in a sealed/locked compartment on board the aircraft) and strict accountability procedures

Standard operating procedures to maintain control of the situation after the device has been used

Recurring maintenance and inspection of the devices

Preventing access to these devices by passengers

We recommend industry work with the FAA to evaluate these factors and make recommendations for personal protection within 6 months. We recommend the implementation of defensive capabilities in accordance with the recommendations of the evaluation, within 1 year of receiving the recommendation.

As to lethal weapons, the Air Line Pilots Association (ALPA) has taken a public position that a volunteer program be established with specific guidelines for arming pilots in flight. Other members of the task force have identified numerous issues requiring resolution before consideration is given to arming the pilots. These issues should be considered to determine whether they can be overcome.

ALPA recommends the FBI present reasons for or against its proposal to arm pilots.

7. Security Training and Delivering Information

Security training is recognized as outdated in respect to today's threats. Both initial and recurrent training programs must be rapidly modernized and delivered to all crewmembers reflecting current threat information. As a minimum, this new training should prepare crewmembers to identify and understand the different levels and types of threats to the safe passage of crew, passengers, and aircraft. Development of this training should use at a minimum the expertise of law enforcement organizations and professionals familiar with hijacking situations.

We recommend industry, unions, and FAA redesign security training to address newly-identified threats within 30 days, incorporate changes into the annual curriculum within 60 days, and provide security training to all crewmembers within 6 months after updating the curriculum.

We recommend that each airline, in cooperation with the FAA or other Government entities, develop within 60 days a delivery system or procedure to provide Government security advisories to crewmembers in a timely manner, including immediate threat information to affected aircraft in flight.

8. Cabin Search Procedures

Recent security directives require cabin search procedures to minimize risk. Current procedures do not guarantee that those conducting cabin searches are trained adequately on best practices and use of the most recent technology. We are concerned that access to the aircraft between the time the cabin search is conducted and flight is not restrictive enough. We endorse the recently introduced FAA Security Directives requiring cabin search procedures. However, there is a need for additional training for those personnel conducting cabin searches.

We recommend the FAA provide more guidance on the conduct of cabin searches within 30 days. Airlines will continue to conduct the cabin search and to provide sufficient time and training for those personnel. No cabin search duties should be assigned to flight or cabin crew.

As a long-term option, we believe this task should be assigned to some sort of Federal security force. Creating such a force would avoid the need to assign additional responsibilities to current carrier personnel who may not be as familiar with dangerous items or who may be performing other duties under limited time constraints.

We concur with the recommendation of the Airport Security Team to develop a new Federal security agency and we recommend that the new agency be responsible for conducting searches of aircraft cabins.

9. Transponders

One lesson from the attacks of September 11th is the importance of ensuring continuous transponder communication with air traffic control (ATC) following a hijacking. Without the transponder switch in a fully active position, ATC can track an aircraft only by primary radar, which does not indicate aircraft identity and altitude. The loss of this information causes other aircraft to lose awareness of the flight in progress.