Aviation Security: A Black Art To Many

Aviation securitySecurity screener to the passenger – Sorry you have to take off your shoes. I don’t make the rules, I just carry them out! “So who does make these damn rules?”

To maintain its effectiveness, the details of aviation security are best left known only to those who ‘need to know’. There is, however, a strong argument for providing a good overview of the organisations, structures, intent and difficulties of this complex and critical field. This should be of particular interest to security managers and practitioners who may have a need to interact with these security systems, or may even consider employment in this field.

Obviously, the aviation industry is a global powerhouse providing not just transportation of persons and goods but also economic multipliers, national prestige and financial yield. Conversely, failures in aviation security (or safety) can decrease or prevent these national and international advantages.

The basis of the international system of aviation security really starts with a group of far seeing and diligent individuals who met in Chicago in 1944.With representation from 54 (mainly Allied) nations, they sat down to thrash out the future of world civil aviation in anticipation of the end of World War Two. The major driving force of discussion came from the United States, the United Kingdom, Canada, Australia and New Zealand and these countries provided initial models for consideration.

Initial concepts including ‘international ownership of all major airlines’ and a single, global ‘oversight or aviation law enforcement’ organisation were not acceptable to the gathered nations. Over a period of five weeks, the group of national representatives hammered out a model and drafted an international treaty known officially as The Convention on International Civil Aviation.

This document, signed on 7 December 1944, is now known as the ‘Chicago Convention’ and it forms the basis for all regulation of global civil aviation; be it in relation to safety, regularity, efficiency or security of services.

Initially, security was not a major part of the Convention which put into place:

  • general principles and application of the Convention, including responsibilities and privileges of the signatory States (nations)
  • international standards and recommended practices for aviation
  • the International Civil Aviation Organisation (ICAO), including its structure, meetings, specialist agencies and financing
  • a system of control of air routes and their usage.

Signatory nations to the convention, of which there are now 190, are known as contracting States; a thought-provoking phrase. Many of these states did not exist in 1944, or were occupied at the time by foreign powers, and some original signatories no longer exist!

The Convention makes it very clear that ICAO (a United Nations Special Agency) is made up of its member states and, therefore, we are ICAO.

This amazing document, the Convention, has stood the test of time as only very minor amendment has been necessary over the last 60 plus years and, while a multitude of additional documents have grown from it, it is still pertinent and effective.

Our question was “Who makes these damm rules?” One of the biggest issues facing the drafters of the Convention was getting the correct balance between states doing their own thing (sovereignty) and states doing roughly the same thing (standardisation). A little bit of study here of the Convention gives us the basis to answer our question.

Article (or Paragraph) 1 of the Convention is pretty clear in that it says “The contracting States recognise that every State has complete and exclusive sovereignty over the airspace above its territory.” Then Article 12 says, in part, “Each contracting State undertakes to keep its own regulations in these respects, uniform, to the greatest possible extent, with those made under this Convention.”

This is reinforced by Article 37, which includes “ Each contracting State undertakes to collaborate in securing the highest practicable degree of uniformity in regulations, standards procedures and organisation in relation to aircraft, personnel, airways and ancillary services…” This Article also goes on to cover the fact that ICAO will make and adopt international standards and recommended practices relating to all of the technical issues of aviation.

But then, the flexibility in this Article means the individual national regulations may not be exactly the same, so we need Article 38 which includes, “Any State which finds it impracticable to comply in all respects with any such standard or procedure… or which deems it necessary to adopt regulations or practices differing in any particular respect from those established by an international standard, shall give immediate notification to the International Civil Aviation Organisation.”

Phew, that is a little hard going; so let’s paraphrase it to make it clear:

  • Each state is responsible for its own ‘stuff’ (Article 1).
  • Each state makes its own rules but tries to keep them the same (Article 12).
  • Each state will try to keep its rules and procedures as close as possible to the standards that ICAO publishes (Articles 37)
  • If the state can’t conform or will be different, they tell ICAO (Article 38).


So, this gets us a little closer to answering the question, I think… Or does it?

Let’s spend some time on these international standards and recommended practices (SARPs) which seem to form the basis of each state’s regulations.

There are now 18 Annexes under the Convention which provide all of the world’s civil aviation SARPs. These started mainly as safety related standards covering such things as personnel licenses, aircraft airworthiness, aerodrome standards, Air Traffic Control procedures and so forth.

The Articles in the Convention that were mentioned above make these SARPs binding on all contracting States, such as Australia. They do NOT, however, have any effect on the aviation industry of any State as the airlines and airports are not signatories to the Convention!

Until the early 1970s, there was no Annex relating specifically to aviation security. World events including hijackings and bombing of aircraft and bombing of terminals drove a need and in 1974 the Council of ICAO adopted Annex 17 to the Convention – Security.

The SARPs themselves across all of the Annexes vary from being mainly ‘outcome based’ to very prescriptive in technical areas. So, if there is a requirement to specify the frequency that a certain aircraft equipment works on, the applicable standard may go down to decimal points of a megahertz.

Conversely, a good example of an outcome based Standard is found in Annex 17 under the Preventative Security Measures chapter. “Standard 4.2.1. Each Contracting State shall ensure that the access to airside areas at airports serving civil aviation is controlled in order to prevent unauthorised entry.”

This standard is clear and provides the required outcome ‘control access to prevent unauthorised entry’. It doesn’t go in to a lot of detail about what is control of access or how it can be achieved, or even what unauthorised means. It just tells the state what is required.

ICAO provides states with many other documents that are considered as ‘guidance material’ and are not specifically binding on the contracting State. They do, however, give examples of acceptable methods to be used to meet this standard. A relevant publication here would be the ICAO Aviation Security Manual (Document 8973-Restricted), which provides these examples and a lot more detail.

If the SARPs provide what needs to be done, then the Guidance Documents can be considered to provide how the outcomes can be met.

The individual standards and recommended practices have changed constantly since 1974 as new threats and risks emerge and new technologies and processes are developed to combat them. In fact, the latest set of changes took effect on 1 July 2011

In subsequent articles, we will expand on SARPs and their relationship to individual States, including Australia and the use of threat and risk assessment methodologies to appropriately set specific security levels. However,  for now, we really need to answer our question.

Each individual contracting State of ICAO is responsible to put in place, under its national legislation, the regulations which will be binding on the State’s aviation industry and the travelling public and many other entities for whom aviation security is an issue. Such regulations should conform, as far as is possible within national priorities, with the requirements of the SARPs and in particular Annex 17.

So, when you have to take off your shoes to go through the screening point before you can get on the aircraft, it is because Australia in 1944 decided to be part of a world-wide aviation system and accepted both the responsibilities and the privileges that this entails. The same is true for almost every other country you might fly from.

John Gratton
John ‘Hondo’ Gratton is managing director of a small consultancy company, Gratton Aviation Services (GAS), based in Melbourne. He has extensive safety and security experience including military EOD/IED Disposal, operations, logistics and international relations. GAS provides consultancy and advisory services to foreign governments in aviation safety and security regulatory systems, oversight mechanisms and operational processes. Recent contracts have included Indonesia, India and DPRK.