Newsletters
Risk Central
Digital Edition
Cyber Threat: Aviation
Unmanned Risk
Sending unpiloted vehicles into manned airspace may sound like a joyride to Amazon CEO Jeff Bezos, who’s speculated that when fully developed, commercial drones may be able to deliver an Amazon order to one’s door in 30 minutes.
But let’s face it: Some possible outcomes of the predicted exponential growth of Unmanned Aircraft Systems (UAS) are not all that pleasant to entertain.
Because it’s managed remotely by computer, a UAS could be hacked and its mission bent to destructive purposes. Or it could simply go awry due to operator error.
“What if a UAS shoots thousands of feet into the air and gets ingested into a commercial aircraft engine full of passengers?” asked Barton Duvall, assistant vice president with Starr Aviation’s West Coast office in Carpinteria, Calif.
Such a scenario “puts an entirely new outlook on the limit needs of UAS operators and the non-owned aviation liability limit needs of customers of UAS operators,” said John Geisen, an Aon aviation senior vice president in Minneapolis.
The loss involved is known as a foreign-object-damage loss or FOD, he said.
Video: Watch this Lakemaid Beer drone delivery.
“The airline’s hull underwriters would pay for the engine and other physical damage as well as any liability that ensues, but in this case you would also have a cause for subrogation to go after the UAS owning and operating parties as well as, I suppose, the customer of the UAS.”
Where adequate coverage limits for negligence actions are not secured, one can expect a search for “deep pockets,” said Geisen.
“Subrogation for FOD losses occurs today when a negligent party responsible for clean up or the owner of the object that is ingested can be clearly identified,” Geisen said.
“Today, it is often hard to identify who owned the foreign object that was left on the tarmac and damaged the engine at takeoff or landing or maybe you eat a bird that no one owns — the hull insurer pays the claim and has nowhere to turn to try and mitigate it — file closed.”
However, should another aircraft “eat or ingest a UAS,” it will be easier to determine who’s responsible, he said.
Starr Aviation’s Duvall said that the worst-case scenario could have the lives of hundreds of passengers at risk as well as damage to the aircraft — some valued at well over $100 million — besides potential grave bodily injury and serious property damage on the ground.
“The chain of liability could span from the operator of the UAS, to the prime manufacturer and subcomponent manufacturers to, depending how these systems end up integrated, the entities responsible for control and safety of the National Airspace System (NAS).
“The actuality of a catastrophic event such as this may be improbable, but it’s not entirely out of the scope of possibility,” said Duvall.
Besides the obvious navigational challenge of sending unpiloted commercial vehicles into the stratosphere, hijacking enabled by cyber terrorism is another real threat.
The Cyber Terror Threat
In 2012, University of Texas professor Todd Humphreys and a group of students intercepted a GPS-guided UAS, using a GPS device created by Humphreys and his students.
Video: Humphreys explains how he hacked the drone.
If that can occur, then what is to prevent a terrorist hacker from directing a drone to pick up a bomb and fly it into a university football game or some similar target, asked Geisen.
In such a situation, “plaintiffs are going to look for the deep pockets,” said Roberta Anderson, a partner in the Pittsburgh office of law firm K&L Gates.
Anderson, who represents policyholders in commercial insurance coverage disputes, said those tapped for indemnification in the terrorist plot described here would likely include “companies that manufactured or designed the software applications, or owned or controlled the networks that allowed a hacker to penetrate the [drone’s] system and gain control.”
“Managers and owners of the stadium would also be targeted for potential negligence and insufficient security, and you’d see cross claims and counterclaims as well, with the stadium pointing the finger at their own security vendors.
“There could be tens of thousands of wrongful death claims” as well as “loss of reputation, property damage and business interruption for the stadium, which will represent a deep-pocket certain to have liability insurance,” Anderson said.
Mitigation Efforts
And yet, there are clearly mitigating factors to help prevent things from going terribly wrong.
A lot of these aircraft are building in “triple redundancies,” with “some even having automatic return-to-base features if there are any control interruptions,” Aon’s Geisen said.
Still, there is little doubt, he said, that commercial drones currently represent “a big area of emerging risk and growth.”
The U.S. military’s use of drones “went from like 50,000 flight hours in 2006 to some 550,000 by the end of 2011,” said Geisen.
“So in just five years you had an 11-fold increase,” he said, suggesting that the growth trajectory on the commercial side could be similar. One reason for growth in drone use: Cost per flight hour “is suggested to be 75 percent less with a UAS than a manned aircraft,” he said.
The U.S. military’s use of drones “went from like 50,000 flight hours in 2006 to some 550,000 by the end of 2011.”
— John Geisen, senior vice president, Aon
One forecast of global UAS demand by the Teal Group showed worldwide annual spending on research, development, testing, and evaluation, and procurement in this area rising from $6.6 billion in 2013, to $11.4 billion in 2022.
And in March, Dallas-based global market research and consulting firm MarketsandMarkets reported that the small UAS market alone is set to reach $582.2 million by the end of 2019.
NTSB Ruling
Accelerating insurers’ and brokers’ efforts to assess and effectively bind risks in this space, meanwhile, was a National Transportation Safety Board administrative law judge’s March 6 ruling overturning the FAA’s first-ever fine against a drone operator.
NTSB Judge Patrick Geraghty ruled that when Raphael Pirker flew an unmanned Styrofoam drone over the University of Virginia in 2011, “there was no enforceable FAA rule or FAR [federal aviation regulations] applicable to model aircraft or for classifying model aircraft as an UAS.”
Pirker reportedly sold photos and video collected during the flight to the university to help it create a promotional video.
Reports about the ruling immediately went viral, leading the science and technology site Motherboard to boldly state that commercial drones had become “unequivocally legal” in American skies — at least temporarily.
Motherboard noted that UAS operations previously sanctioned by the FAA included beer deliveries, aerial photography, tornado watching, and equipment inspections.
Industry Standards
The FAA appealed the ruling, saying “the agency is concerned that this decision could impact the safe operation of the national airspace system and the safety of people and property on the ground.”
Congress asked the FAA to come up with a plan for safe integration of UAS by Sept. 30, 2015, and industry members expect to have some standards to work with by then.
Industry experts are trying to be patient.
A Feb. 26 post on the FAA’s website, titled Busting Myths about the FAA and Unmanned Aircraft, clearly stated: “Anyone who wants to fly an aircraft — manned or unmanned — in U.S. airspace needs some level of FAA approval.”
Commercial UAS flights are only authorized on a case-by-case basis, the agency emphasized, adding that “to date, only two UAS models (the Scan Eagle and Aerovironment’s Puma) have been certified, and they can only fly in the Arctic.”
According to Duvall, the September 2015 UAS integration deadline “may be quite difficult to meet,” considering that the preliminary notice of proposed rulemaking and public solicitation on the issue has been pushed back to November 2014.
Elsewhere, “this industry is growing by leaps and bounds,” with Japan, Greece, Canada and parts of Africa now using the technology for everything from farming to mapping to anti-animal poaching efforts, Duvall said.
On the other hand, Geisen said, the FAA is likely to propose some rules for commercially operating drones under 55 pounds before the end of this year.
Insurance carriers said they will not be asleep at the switch.
“Once the FAA have completed their work on integrating unmanned aircraft into U.S. airspace, I would assume that we will very quickly see their commercial use proliferate, particularly in relation to agricultural and utility operations,” said Chris Proudlove of aviation underwriter Global Aerospace Inc.
Complete coverage on the inevitable cyber threat:
Risk managers are waking up to the reality that the cyber risk landscape has changed.
Cyber: The New CAT. It’s not a matter of if, but when. Cyber risk is a foundation-level exposure that must be viewed with the same gravity as a company’s property, liability or workers’ comp risks.
Critical Condition. The proliferation of medical devices creates a host of scary risks for the beleaguered health care industry.
Disabled Autos. It’s alarmingly easy for a hacker to take control of a driverless vehicle, tampering with braking systems or scrambling the GPS.
An Electrifying Threat. There is a very real possibility hackers could devastate the nation’s power grids — for a potentially extended period of time.
