An Air Canada plane and Bombardier aircraft had their GPS systems hacked in flight

An Air Canada plane as well as devices manufactured by Bombardier recently saw their GPS positioning systems hacked by cyberattacks while in mid-flight.

These incidents occurring over the Middle East and South Asia endanger air safety, worry experts and four pilots who spoke to our Investigation Office in recent weeks.

On May 9, 2023, an Air Canada Boeing 787 saw its navigation system blocked during a flight between Seoul, South Korea, and Toronto, Transport Canada confirmed to us.

The pilots then had to navigate with the assistance of air traffic controllers, since their GPS system was no longer receiving a signal.

Then, last fall, at least three Bombardier business jets flying over the Middle East suffered even more serious incidents.

• Listen to the legal segment with Félix Séguin via
  :

Their GPS system was receiving downright misleading signals to make the crew believe that their plane was somewhere other than where it actually was (see box).

In one case, the pilots no longer had any idea where the aircraft was.

In prohibited area

These cases, as well as around fifty others occurring since the end of August 2023, were compiled by the OPS Group, an organization which brings together 8,000 pilots, air traffic controllers and other aviation specialists, and recognized as a reference in information on aviation safety.

The sending of misleading signals raises great fears: “The GPS receiver does not trigger an alert, and that is dangerous,” says an Air Canada pilot, who speaks on condition of anonymity because he is not authorized to speak to the media.

Thus, at least one plane accessed a prohibited zone above Lebanon and another almost entered Iranian airspace without authorization, we can also learn from the OPS Group.

According to another source at Air Canada, most of these cyberattacks come from governments targeting planes and drones in certain areas at risk of armed conflict.

“These military state operations border on terrorism,” indicates this source.

ICAO alert

In October 2022, the International Civil Aviation Organization (ICAO) – headquartered in Montreal – alerted its 193 member countries of fears that a fatal incident would occur.

“Intentionally sending misleading signals to replace the correct signal is a threat […] serious for flight safety,” we can read in a resolution from the organization.

ICAO “urges Member States to refrain from any form of intentional jamming or deception affecting civil aviation,” indicates the same resolution.

Called for comment, ICAO communications officer William Raillant-Clark admits that “Member States are concerned about the resilience of systems”, or the weak capacity of systems to adapt to this type of hacking.

Suspended flights

Bombardier says it is well aware of the incidents that affected its planes earlier this fall. “We continue to treat these incidents as a priority,” says spokesperson Arevig Afarian.

The Quebec aircraft manufacturer specifies that it does not design the navigation systems of its aircraft. “We still send technical updates and directives to our customers on any security issues,” says Ms. Afarian.

For its part, Air Canada confirms that it is aware of this type of incident and has suspended all its flights to Tel Aviv since the worsening of the conflict between Israel and Hamas.

The situation is “well documented[e] by Boeing, manufacturer of the aircraft we operate […] with robust procedures,” indicates vice-president of communications Christophe Hennebelle.

“Failure becomes dangerous,” says pilot

Air Canada pilots fear a major incident could occur due to the emergence of aerial cyberattacks.

• “We blindly trust our navigation systems and failures become dangerous,” says one of them, who confided in us in exchange for a promise to keep his identity anonymous.

At Air Canada, management did not make pilots aware of the existence of these sophisticated attacks, according to the four pilots of the air carrier with whom we were able to speak.

“It’s scary. We did not know that all of our navigation systems could be put out of action,” alerts one of the employees.

Fear of disaster

“Our flight simulator training and qualifications don’t even include GPS spoofing scenarios,” adds another pilot.

In a context where the geopolitical climate is explosive in several parts of the world, “we are never safe from a major incident,” he continues.

In this regard, according to the OPS Group, pilots in flight have recently received worrying radio messages that the Iranian state would not hesitate to shoot down any aircraft that flies over prohibited areas.

Such a scenario is reminiscent of the case of the Ukraine International Airlines plane in January 2020, which was shot down by the Iranian army in unclear circumstances a few minutes after taking off from Tehran.

The disaster resulted in the deaths of 176 passengers, mainly Canadians and Iranians.

The industry must adjust

The Journal sought advice from two aviation experts on the emerging threat of cyberattacks.

Is it really possible to hack a plane remotely?

Hacking a plane remotely is not as easy as thwarting a standard car or cell phone system, but it is far from impossible, explains Jose M. Fernandez, a former teacher at Polytechnique Montréal and expert, in an interview. in cybersecurity and airline pilot.

“No system can protect us against all cyberattacks,” he observes.

The ability to block the GPS tracking system and send false signals was once reserved for the military arsenal. But this capability is no longer exclusive to the military, he notes.

Have means been planned to prevent such disruptions?

Mr. Fernandez is not very reassuring, because to date, nothing has yet been designed in the aviation industry to protect against any form of cyber attack.

Rather, navigation systems were developed to correct errors and inaccuracies, equipment failures and human errors.

The aeronautics industry “has put almost all its efforts into preventing terrorism and hostage-taking on board aircraft,” he observes.

What solutions are possible in the short and medium term?

Mr. Fernandez indicates that we must start by informing the pilots of the situation. It is then necessary to change the emergency procedures and train the crew to react properly.

In the medium term, he considers that it will be necessary to adapt the systems to new threats. This could cost “hundreds of thousands of dollars for each airliner,” he said.

According to deputy director of the Institute of Air and Space Law at McGill University Vincent Correia, this will not happen overnight, because the industry sometimes takes 10 to 15 years before reacting.

“The implementation of new technologies must be compulsory and uniform throughout the world,” says Mr. Correia.

Five recent cases

Bombardier Global 6000 Express – October 16, 2023

An air traffic controller advised the crew that the plane was approaching a prohibited area after taking off from Tel Aviv in Israel. The GPS system, which had been hacked, indicated an incorrect position of the aircraft.

Bombardier Challenger 604 – fall 2023

While approaching northern Baghdad, Iraq, the GPS system was impersonated. The pilots had to seek assistance from air traffic controllers because they had no idea where they were.

Bombardier Global 7500 – October 16, 2023

The navigation system was the target of three identity thefts during the same flight between Tel Aviv in Israel and Cairo in Egypt. The aircraft lost use of all its navigation equipment and regained it after moving away from Israel.

Embraer Legacy 650 – fall 2023

The aircraft lost use of all its navigation systems upon entering the airspace of Baghdad, Iraq. The pilots did not realize this until the autopilot changed the plane’s direction on two occasions.

Boeing 777 – October 16, 2023

The airliner was the target of an attack on its navigation system. For 30 minutes, the GPS indicated that the plane was over Israel when it was actually flying over Egypt.

Source: OPS Group. Cases disclosed in September and October 2023.

-With the collaboration of Chrystian Viens.