operational-safety/Aircraft-Parking

Aircraft Parking and Storage

Due to the current global COVID-19 crisis, an unusually large number of commercial aircraft is currently parked or stored and are out of revenue service for an extended amount of time.

General information

This section provides specific OEM-identified measures to support operators in storing and preserving aircraft to allow for a smooth return to service as flight activities progressively return to normal. Operators are reminded that storage and maintenance actions on a stored aircraft must be approved by the State of the registry as part of the aircraft maintenance program.

Categories of parking and storage conditions
Main watch areas for parking and storage of aircraft
- Exterior Corrosion on Bare Metal Surfaces
  - Keeping bare metal surfaces clean and free of corrosion is a key consideration aircraft storage.
  - During storage operators should inspect these areas and take preventative measures to protect bare metal surfaces.
  - It is good practice to consistently apply corrosion preventative compounds or implement regular aircraft cleaning schedules.
  - Extensive corrosion on surfaces could limit part life and possible cause out of sequence maintenance or repair during the return to service of the aircraft.
- Interior Cleanliness
  - During the preparation for preservation it is important to clean the interior of the aircraft to remove any food based material.
  - During storage operators should regularly inspect the cabin interior to ensure it is clean and free of contamination.
  - The presence of interior contamination can reduce the appearance of interior surfaces and may shorten the life of components, and increase return to service maintenance or cleaning.
- Insect and Animal Nesting
  - During storage, insects and animals will often make nests or store food in openings in the aircraft such as engines, control surfaces, vents, and probes.
  - When possible, these openings should be covered to minimize the likelihood of animal nesting, and these locations should also be inspected regularly during storage as well as during return to service preparation.
  - Animal nesting can possibly cause component failure during service of the aircraft, and extensive nesting can significantly impact aircraft performance.
- Cabin Temperature and Humidity
  - Maintaining average cabin humidity below 70% relative humidity is recommended in order to minimize mold and corrosion issues.
  - With airplanes stored all around the world in a range of different environments operators need to continue monitor conditions with the cabin and operate their environmental conditioning systems and possibly utilize desiccant bags to maintain consistent humidity levels.
  - Maintaining consistent humidity levels reduces the risk of damage to interiors and electronic components, and minimizes unscheduled maintenance on these components when the aircraft returns to service.
- Fuel Drainage and Microbiological Contamination
  - When moisture is present in the fuel it can increase the risk of microbiological growth which can contaminate the fuel.
  - The presence of moisture can also cause corrosion to the fuel tank metal structure.
  - Operators should perform preventative maintenance which may include adding fuel additives to reduce microbiological growth and performing regular sumping of the moisture that has accumulated in the fuel tank.
  - If operators find corrosion or microbiological growth in the fuel tank it will need to be drain and serviced which can be a time consuming and costly maintenance activity.
- Power Plant and APU
  - If the operator has the aircraft in long term storage the engine (or power plant) and the auxiliary power unit (APU) will be preserved using special procedures including adding preservation oil.
  - If the operator is maintaining the aircraft under short term or active storage procedures, the engine and the APU will be operated regularly and used to help operate the ECS system to help maintain cabin humidity.
  - At return to service the operator will need to perform maintenance on the APU and engine based on the OEM requirements.
- Flight Controls
  - To prepare for storage the operator may lubricate movable flight control components and ensure surfaces are clean to prevent corrosion.
  - During short term or active storage the operator will periodically operate control surfaces and examine components for corrosion, wear, or animal infestations.
  - As part of returning the airplane to operational service, the operator will inspect the flight control surfaces for signs of environmental damage such as corrosion or pitting, and flight control cables may be lubricated and checked for proper tension.
- External Sensors(e.g. pitot probes)
  - Exterior sensors such as pitot tubes or other ports have orifices that can attract debris or insects.
  - Prior to returning the aircraft to operational service the operator should inspect these sensors for any signs of damage or nesting, and perform the necessary flushing procedures to ensure proper operation of these systems.
  - The presence of foreign objects in these systems could cause the systems to give false readings which may lead to flight delays and additional unscheduled maintenance.
- Landing Gear, Wheels & Tires
  - The landing gears and wheel wells of the aircraft are very susceptible to dirt and debris during normal operation.
  - Therefore, in preparation for storage operators should extensively clean these areas, and apply corrosion preventive compounds to bare metal surfaces to maintain healthy components.
  - Special care should be provided to the tire and wheel assembles to cover with UV resistant plastic to prevent damage to the tires and minimize break and wheel corrosion.
  - During storage, operators should rotate tires to prevent flat spots or premature ware of the tread.
- Environmental Conditions
  - The environment where the aircraft is stored can significantly impact the amount of man-hours the operator will need to spend maintaining the aircraft.
  - For instance, if the aircraft is stored in a low humidity climate away from the coast the aircraft will see less corrosion on the exterior surfaces, and lower microbiological growth in interiors and wet fuel tanks.
- Electrical Components
  - During long term storage operators may remove many electrical components and batteries, and store them in environmentally controlled spaces.
  - For short term or active storage, operators may choose to leave these electrical components and batteries on the aircraft to regularly operate the aircraft.
  - Care should be given to maintain humidity levels and temperatures within OEMs recommended limits for all electrical components which remain on the aircraft.
- Seals and Gaskets
  - To prevent gaskets and seals from becoming brittle or drying out, operators can regularly inspect and maintain components per OEM guidelines.
  - To maintain gaskets in the fuel tank operators can keep fuel levels high enough to cover fuel system components to maintain gasket moisture during storage.
- Return to Service Checks
  - Each aircraft OEM has designed special return to service maintenance checks which incorporate lessons learned from each operator, and help ensure the aircraft will operate safely.
  - The operator may have specific needs related to their storage program or operations which may require tailored return to service procedures.
  - The operator may work with the OEM to identify the operation specific needs.
- Scheduled Maintenance Interval Extensions
  - Scheduled maintenance tasks are periodically performed during normal operations of an aircraft.
  - During aircraft storage, an operator may decide to defer certain scheduled maintenance procedures until a later time base on their operational needs.
  - An operator may also work with their local regulatory authority to review the standard scheduled maintenance procedures to determine if they are eligible to extend any of their calendar driven maintenance cycle
- Airplane Spacing
  - During storage the aircraft will typically be parked near other aircraft, and the spacing between these aircraft is a consideration.
  - Aircraft should be spaced to allow for maintenance and emergency vehicles to safely access the aircraft.
  - During storage the aircraft may experience high winds which can potentially cause the aircraft to move, and operators should consider this potential for movement when parking aircraft together.
  For comprehensive guidance on parking and storage of aircraft refer to the IATA Guidance for Managing Aircraft Airworthiness for Operations During and Post Pandemic.

Security issues

The COVID-19 pandemic has forced many organizations to undergo significant transformation, rethinking key elements of their business processes and using information and communication technologies to support their operations.

This evolution, along with the unprecedented occupancy rate of the usual aircraft parking areas or the use of new ones, is likely to create staff dissatisfaction, new threat vectors and/or increased vulnerabilities that need to be addressed quickly in security risk management activities. This section provides guidance on measures to address threats to parked and stored aircraft in relation to:

Physical Security

Control of Physical Access to Aircraft

Threat	Considerations
The grounding of thousands of aircraft that need to be parked/stored for a long time during the COVID pandemic creates an opportunity for unauthorized access to aircraft	Measures should be put in place on the aircraft as a complement/compensation to measures that exist or should exist in its parking/storage environment. If the aircraft parking and storage area was not physically controlled, if the level of security of the area is unknown or not considered to be sufficient or in the event of a proven circumventing/failure of the measures to control physical access to the aircraft then the return to service criteria must be thorough to validate the aircraft is in the correct state. Validation should include three objectives: Absence of dangerous/forbidden goods and absence of sabotage/tampering of systems (as documented in ICAO annex 17 standards 4.1 and 4.3) and non compromising of aircraft hardware configuration.

Threat

Considerations

The grounding of thousands of aircraft that need to be parked/stored for a long time during the COVID pandemic creates an opportunity for unauthorized access to aircraft

Measures should be put in place on the aircraft as a complement/compensation to measures that exist or should exist in its parking/storage environment.
If the aircraft parking and storage area was not physically controlled, if the level of security of the area is unknown or not considered to be sufficient or in the event of a proven circumventing/failure of the measures to control physical access to the aircraft then the return to service criteria must be thorough to validate the aircraft is in the correct state.
Validation should include three objectives: Absence of dangerous/forbidden goods and absence of sabotage/tampering of systems (as documented in ICAO annex 17 standards 4.1 and 4.3) and non compromising of aircraft hardware configuration.

Aircraft Hardware Configuration

Threat	Considerations
The grounding of thousands of aircraft that need to be parked/stored for a long time during the COVID pandemic creates an opportunity for unauthorized access to aircraft	Considerations for the aircraft hardware configuration are the following: Physical Inspection of aircraft to validate hardware configuration. The proper part number components and systems are checked to match the approved aircraft configuration and no physical parts are missing (potential theft). The level of physical inspection is dependent on the situation and judgement of the operator and regulator if appropriate. Maintenance systems and aircraft reporting capabilities should be used to create a report of the current state of the aircraft and this can be compared against the approved configuration. Physical Inspection of aircraft to validate all data ports are not connected to unauthorized devices. Aircraft typically include data ports located in controlled areas of the aircraft such as flight deck, EE Bay etc. to allow for software installation and data retrieval. Foreign devices found connected to data ports in the flight deck, Crew panels, maintenance areas, cabin, etc. should be investigated as to legitimacy of connection (authorized by maintenance action). Unauthorized devices can provide direct or remote access to aircraft systems. If not validated as an authorized device, connected systems should be considered compromised and corrupted. Maintenance actions should be performed to check the integrity of the connected systems and whenever necessary restore them according to the

Threat

Considerations

The grounding of thousands of aircraft that need to be parked/stored for a long time during the COVID pandemic creates an opportunity for unauthorized access to aircraft

Considerations for the aircraft hardware configuration are the following:

Physical Inspection of aircraft to validate hardware configuration. The proper part number components and systems are checked to match the approved aircraft configuration and no physical parts are missing (potential theft). The level of physical inspection is dependent on the situation and judgement of the operator and regulator if appropriate.
Maintenance systems and aircraft reporting capabilities should be used to create a report of the current state of the aircraft and this can be compared against the approved configuration.
Physical Inspection of aircraft to validate all data ports are not connected to unauthorized devices. Aircraft typically include data ports located in controlled areas of the aircraft such as flight deck, EE Bay etc. to allow for software installation and data retrieval.
Foreign devices found connected to data ports in the flight deck, Crew panels, maintenance areas, cabin, etc. should be investigated as to legitimacy of connection (authorized by maintenance action). Unauthorized devices can provide direct or remote access to aircraft systems. If not validated as an authorized device, connected systems should be considered compromised and corrupted. Maintenance actions should be performed to check the integrity of the connected systems and whenever necessary restore them according to the

Personnel Involved in Aircraft Search and Inspection

Threat	Considerations
Due to the COVID pandemic, experienced search and inspection personnel may not be available to perform their duties	Validate the personnel performing search and inspection duties are trained and have appropriate oversight depending on their experience. To counteract the insider threat, it is advised to verify the searcher credentials and the operator may consider an update to background checks. Validate the search and inspection procedures detail the objectives to: Discover suspicious objects, weapons, explosives or other dangerous devices Identify the sabotage of aircraft physical parts Validate aircraft maintenance data ports are free from unauthorized electronic devices

Threat

Considerations

Due to the COVID pandemic, experienced search and inspection personnel may not be available to perform their duties

Validate the personnel performing search and inspection duties are trained and have appropriate oversight depending on their experience.
To counteract the insider threat, it is advised to verify the searcher credentials and the operator may consider an update to background checks.
Validate the search and inspection procedures detail the objectives to:
Discover suspicious objects, weapons, explosives or other dangerous devices
Identify the sabotage of aircraft physical parts
Validate aircraft maintenance data ports are free from unauthorized electronic devices

Cyber Security

Aircraft Software Configuration

Threat	Considerations
The COVID pandemic has created the potential for challenges in managing the aircraft software configuration including the lack of security or functionality updates as well as the potential for corruption of software parts due to lapses in physical security of the aircraft or other unauthorized alteration of aircraft software.	Software configuration is reviewed and validated Updates for Navigation Databases are made and current Available Service Bulletins involving software updates are applied to aircraft systems if applicable Aircraft ownership changes may create challenges in maintaining the proper software configuration either through lack of software updates or lack of visibility of the proper configuration. Log review, validation and archiving of all software relative to critical systems, to ensure that no illicit software was illicitly installed or connected to the aircraft, illicit aircraft system access or modification during parking & storage. Should an illicit action be suspected, maintenance actions should be performed to check the integrity of the connected systems and, whenever necessary, restore them according to the Aircraft OEM and/or equipment/part manufacturer instructions.

Threat

Considerations

The COVID pandemic has created the potential for challenges in managing the aircraft software configuration including the lack of security or functionality updates as well as the potential for corruption of software parts due to lapses in physical security of the aircraft or other unauthorized alteration of aircraft software.

Software configuration is reviewed and validated
Updates for Navigation Databases are made and current
Available Service Bulletins involving software updates are applied to aircraft systems if applicable
Aircraft ownership changes may create challenges in maintaining the proper software configuration either through lack of software updates or lack of visibility of the proper configuration.
Log review, validation and archiving of all software relative to critical systems, to ensure that no illicit software was illicitly installed or connected to the aircraft, illicit aircraft system access or modification during parking & storage. Should an illicit action be suspected, maintenance actions should be performed to check the integrity of the connected systems and, whenever necessary, restore them according to the Aircraft OEM and/or equipment/part manufacturer instructions.

Aircraft Software Credentials

Threat	Considerations
Aircraft security credentials are in a known proper state	Expiry dates of cryptographic materials should be checked Availability of Certificate Revocation Lists, whenever they exist, should be confirmed Log review, validation and archiving of maintenance relative to the aircraft security credentials systems, to ensure that no illicit software was, at some point, illicitly installed or connected to the aircraft or that the aircraft was illicitly accessed or modified during parking and storage. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the credential systems and, whenever necessary, restore them according to the Aircraft OEM and/or equipment/part manufacturers instructions. Updates are applied to the credential systems if required. See comment above

Threat

Considerations

Aircraft security credentials are in a known proper state

Expiry dates of cryptographic materials should be checked
Availability of Certificate Revocation Lists, whenever they exist, should be confirmed
Log review, validation and archiving of maintenance relative to the aircraft security credentials systems, to ensure that no illicit software was, at some point, illicitly installed or connected to the aircraft or that the aircraft was illicitly accessed or modified during parking and storage. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the credential systems and, whenever necessary, restore them according to the Aircraft OEM and/or equipment/part manufacturers instructions.
Updates are applied to the credential systems if required. See comment above

Personnel involved in Aircraft Maintenance

Threat	Considerations
The proper maintenance of a commercial aircraft requires a combination of knowledgeable personnel with the proper training to accomplish their tasks. The COVID pandemic may disrupt the normal routine of maintaining aircraft and may require personnel not normally assigned these tasks to perform maintenance actions.	Validate the credentials and security training for personnel involved in aircraft maintenance are current If a AMO (Approved Maintenance Organization) or CAMO (Continuing Airworthiness Maintenance Organization) is involved or responsible for the aircraft return to service there are several concerns as follows: Does the AMO or CAMO have current and non-maliciously modified information regarding the proper configuration of the aircraft. Do the AMO or CAMO personnel have the proper training to perform the maintenance tasks including cyber security training. Are the tools and processes used by the AMO or CAMO properly configured to securely perform the tasks required. What screening procedures or security procedures are in place for who can access the aircraft. Maintenance schedules should be made to allow sufficient time for careful work and quality assurance checks of the work performed.

Threat

Considerations

The proper maintenance of a commercial aircraft requires a combination of knowledgeable personnel with the proper training to accomplish their tasks. The COVID pandemic may disrupt the normal routine of maintaining aircraft and may require personnel not normally assigned these tasks to perform maintenance actions.

Validate the credentials and security training for personnel involved in aircraft maintenance are current
If a AMO (Approved Maintenance Organization) or CAMO (Continuing Airworthiness Maintenance Organization) is involved or responsible for the aircraft return to service there are several concerns as follows:
- Does the AMO or CAMO have current and non-maliciously modified information regarding the proper configuration of the aircraft.
- Do the AMO or CAMO personnel have the proper training to perform the maintenance tasks including cyber security training.
- Are the tools and processes used by the AMO or CAMO properly configured to securely perform the tasks required.
- What screening procedures or security procedures are in place for who can access the aircraft.
- Maintenance schedules should be made to allow sufficient time for careful work and quality assurance checks of the work performed.

Security Maintenance Tools/Ground Support Equipment

Threat	Considerations
The COVID Pandemic may have disrupted the normal maintenance and configuration management of the software dataloaders, media loaders and software maintenance devices and these should be verified to be suitable for use on an aircraft	Dataloaders, media loaders & maintenance devices are reviewed to validate the proper configuration such as the physical device part number and software configuration are correct. Dataloader integrity is known and validated Dataloaders, media loaders & maintenance system security functions (anti-malware etc.) are current. Run malware check of the devices prior to connecting to aircraft Electronic Tools have likely been stowed. Before Electronic Tools can be used, the operator should ensure these tools have been updated with all relevant patches and software updates to ensure secure operation. (software Patches, Operating system updates, Anti-virus updates) Automated log (system and security) review if applicable for validation and archiving of access control or tasks carried-out on the devices. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the crew devices and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions New events and new credential system logs to be integrated into the Aircraft logs if applicable If maintenance systems have been modified to install remote access capabilities for aircraft monitoring or connection to aircraft systems, these systems should be verified to be approved for use on the aircraft in service or removed and the aircraft restored to an approved configuration

Threat

Considerations

The COVID Pandemic may have disrupted the normal maintenance and configuration management of the software dataloaders, media loaders and software maintenance devices and these should be verified to be suitable for use on an aircraft

Dataloaders, media loaders & maintenance devices are reviewed to validate the proper configuration such as the physical device part number and software configuration are correct.
Dataloader integrity is known and validated
Dataloaders, media loaders & maintenance system security functions (anti-malware etc.) are current.
Run malware check of the devices prior to connecting to aircraft
Electronic Tools have likely been stowed. Before Electronic Tools can be used, the operator should ensure these tools have been updated with all relevant patches and software updates to ensure secure operation. (software Patches, Operating system updates, Anti-virus updates)
Automated log (system and security) review if applicable for validation and archiving of access control or tasks carried-out on the devices. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the crew devices and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions
New events and new credential system logs to be integrated into the Aircraft logs if applicable
If maintenance systems have been modified to install remote access capabilities for aircraft monitoring or connection to aircraft systems, these systems should be verified to be approved for use on the aircraft in service or removed and the aircraft restored to an approved configuration

Aircraft Automated Logs

Threat	Considerations
Aircraft automated security logs are reviewed to support the identification of potential unusual activity to support management of the cyber-security risks	Aircraft automated logs (security and systems logs) should be reviewed for content and unusual activity on enabled aircraft and timestamps noted for unusual activity during the storage period. Check the automated log to verify aircraft were not powered on without proper authorization Security Log review, validation and archiving of all maintenance devices, systems like Dataloaders, media, all software and all software credential systems should be performed to ensure that no illicit activities like unapproved software installation, remote connections to the aircraft, illicitly accessed or modified assets, nor intrusions during parking and storage occurred. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the potentially affected systems and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions.

Threat

Considerations

Aircraft automated security logs are reviewed to support the identification of potential unusual activity to support management of the cyber-security risks

Aircraft automated logs (security and systems logs) should be reviewed for content and unusual activity on enabled aircraft and timestamps noted for unusual activity during the storage period.
Check the automated log to verify aircraft were not powered on without proper authorization
Security Log review, validation and archiving of all maintenance devices, systems like Dataloaders, media, all software and all software credential systems should be performed to ensure that no illicit activities like unapproved software installation, remote connections to the aircraft, illicitly accessed or modified assets, nor intrusions during parking and storage occurred. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the potentially affected systems and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions.

Crew Devices

Threat	Considerations
Flight and Cabin Crew Devices such as IPADs, Surfaces and other portable electronic devices not permanently installed on the aircraft are validated to be in an approved configuration and are free from malicious software. Compromised devices may pose a threat to other aircraft systems as they may connect via wired or wireless connections to aircraft systems	Operating system updated as appropriate. System updates are important to keep the units current with the manufacturers recommendations and typically close vulnerabilities in the systems if found. Service bulletins applied as required Security measures in place to check that the electronic devices are free from malicious software that could contaminated the systems connected to them Training updated (if required) Crew should be reminded to bring to Airline attention any unexpected behaviour of crew devices for Operator action. Security Log review if applicable for validation and archiving of access control or tasks carried-out on the device. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the crew devices and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions.

Threat

Considerations

Flight and Cabin Crew Devices such as IPADs, Surfaces and other portable electronic devices not permanently installed on the aircraft are validated to be in an approved configuration and are free from malicious software. Compromised devices may pose a threat to other aircraft systems as they may connect via wired or wireless connections to aircraft systems

Operating system updated as appropriate. System updates are important to keep the units current with the manufacturers recommendations and typically close vulnerabilities in the systems if found.
Service bulletins applied as required
Security measures in place to check that the electronic devices are free from malicious software that could contaminated the systems connected to them
Training updated (if required)
Crew should be reminded to bring to Airline attention any unexpected behaviour of crew devices for Operator action.
Security Log review if applicable for validation and archiving of access control or tasks carried-out on the device. Should an illicit action be suspected maintenance actions should be performed to check the integrity of the crew devices and, whenever necessary, restore them according to the Aircraft and/or equipment / part manufacturers instructions.

Aircraft Parking and Storage

​General information

Security issues

General information