With more than 40 years experience in the aviation industry, The Honorable John Goglia, was the first and only Airframe and Powerplant mechanic to receive a presidential appointment to the National Transportation Safety Board (NTSB). He served from August 1995 to June 2004.&nbsp; &nbsp;
As a Board Member, Mr. Goglia distinguished himself in numerous areas of transportation safety. In particular, he was instrumental in raising awareness of airport safety issues, including the importance of airport crash fire and rescue operations and the dangers of wildlife at airports. He played a key role in focusing international attention on the increasing significance of aircraft maintenance in aviation accidents. He pressed, successfully, for greater integration of civilian and military safety information, becoming a featured speaker at national aviation symposiums attended by military leaders and major defense contractors. He is a leading proponent of airplane child safety seats.
Prior to becoming a Board Member, Mr. Goglia held numerous positions in the airline industry. He started as a mechanic for United Airlines and eventually joined Allegheny, which became USAir. Additionally, he was involved for more than 20 years as a union flight safety representative on accident investigation teams. There, he developed a safety program for his union, the International Association of Machinists, and was its representative for NTSB investigations. For twelve years, he operated his own aircraft service company.
Numerous prestigious groups have recognized Mr. Goglia’s contributions to aviation safety.&nbsp; Aviation Week &amp; Space Technology awarded him a coveted 2004 Laurel for his outstanding service as an NTSB Board member.&nbsp; The Society of Automotive Engineers presented him with the Aerospace Chair Award for outstanding leadership in 2003 and the Marvin Whitlock Award for outstanding management accomplishment in 2002.

Writer

John Goglia

Those of you familiar with safety management systems know that one of the four so-called pillars of SMS is safety promotion.&nbsp;(For those not familiar with SMS, the other three pillars are safety policy, safety risk management, and safety assurance.)&nbsp;As one of the critical components of any SMS program, safety promotion includes communicating to relevant employees information necessary for them to do their jobs safely.&nbsp;

 


While the FAA’s SMS rule currently applies only to Part 121 air carriers at this time, many aviation companies—especially Part 135 air carriers that fly to Europe—have adopted SMS programs because of the safety benefits and because such programs frequently result in cost-savings by reducing or eliminating the costs of incidents and accidents, including injuries to employees and damage to property.&nbsp;The FAA’s rule—Federal Aviation Regulation Part 5 <a href="https://ecfr.io/Title-14/pt14.1.5">https://ecfr.io/Title-14/pt14.1.5</a>—includes “safety communication” as a component of its safety promotion requirement.&nbsp;The rule includes the following requirement, among others: “The [air carrier] must develop and maintain means for communicating safety information that, at a minimum…conveys hazard information relevant to the employee’s responsibilities.”&nbsp;The rule does not define the word “conveys,” so we can assume its ordinary dictionary definition, one synonym being “communicate.”

 


But is it really enough to just “communicate?”&nbsp; Or should we be including a requirement to ensure that your message is read, understood—and most importantly—acted upon appropriately? I have been a long-time proponent of safety management systems and have co-authored three textbooks on the subject.&nbsp;But even being immersed in the subject, I sometimes struggle with how to accomplish some of the most basic tenets of an SMS program—in this case, safety communication.&nbsp;Sure, it’s easy to give employees information, but harder to ensure that they receive and act appropriately on it.&nbsp;Especially in the age of email, texts and other electronic means of sending messages, you can reach a worldwide group of employees in seconds.&nbsp;But have you successfully communicated?&nbsp;One of my pet peeves when I was a Member of the National Transportation Safety Board was asking an employee if something was successfully accomplished and hearing the response, “Yes, I sent him an email.”&nbsp;

 


I’m pondering all this because of an interesting podcast I’ve been listening to called Breach <a href="https://www.carbonite.com/podcasts/breach/">https://www.carbonite.com/podcasts/breach/</a>, which looks at some of the world’s biggest data breaches.&nbsp;Cybersecurity is not only a critical privacy and national security issue, but I also see it as having implications for the safety of our transportation system.&nbsp;The podcast examines how several major data breaches occurred and includes&nbsp;interviews with cybersecurity experts at the U.S. General Accountability Office or GAO—Congress’s investigative agency—regarding the major breach two years ago at the credit reporting company, Equifax. I was particularly struck by the analysis of what led to the Equifax breach, because it has such implications for aviation’s communication of critical safety information.&nbsp;I decided to dig deeper and review the GAO’s report.

 


A short recap of the Equifax breach&nbsp;<a href="https://www.gao.gov/products/GAO-18-559">https://www.gao.gov/products/GAO-18-559</a> :&nbsp;“In March 2017, unidentified individuals discovered the presence of a known vulnerability in software running on Equifax’s online dispute portal that could be used to obtain access to the system. In May of that year, attackers exploited the vulnerability and began to extract data containing PII [personally identifiable information] from Equifax’s information systems.” The breach “resulted in the compromise of records containing the PII of at least 145.5 million consumers in the U.S. and nearly 1 million consumers outside of the U.S.”

 


I highlight&nbsp;the words “known vulnerability” because Equifax had been informed by a little-known agency within the Department of Homeland Security—U.S. Computer Emergency Readiness Team (US-CERT) —that a vulnerability in certain software had been discovered.&nbsp;The mission of&nbsp;US-CERT is to catalog&nbsp;vulnerabilities and disseminate them to government agencies and the public so they can be addressed.&nbsp;Of course, disseminating them to the public means hackers also become aware of the vulnerabilities so companies have to act fast when they’re notified of a problem.

 


According to the GAO, Equifax did act quickly on the information it received and sent out an email to some 430 employees with information on the software vulnerability and the patch to be applied. “According to Equifax officials, the [software] vulnerability was not properly identified as being present on the online dispute portal when patches for the vulnerability were being installed throughout the company. After receiving a notice of the vulnerability from the United States Computer Emergency Readiness Team in March 2017, Equifax officials stated that they circulated the notice among their systems administrators. However, the recipient list for the notice was out-of-date and, as a result, the notice was not received by the individuals who would have been responsible for installing the necessary patch.”

 


So, basically, 145.5 million people had their identities put at risk of being stolen because an Equifax email list of system administrators had not been updated! In addition, it appears that Equifax did not have a system for ensuring that mandatory patches were actually applied—in other words, ensuring that an email sent to hundreds of people responsible for protecting the private information of hundreds of millions of people had been properly acted upon.

 


So, the moral of the story here is, if it can happen to Equifax it can happen to any one of us who sends important safety messages out into the ether and expects them to be read, understood and acted upon.&nbsp;This is true whether the message goes to one person or to hundreds or even thousands.&nbsp;

 


Of course, I’m not suggesting that we stop using electronic means of communication.&nbsp;And I’m certainly not suggesting resorting to word of mouth – the game of telephone comes to mind.&nbsp;But I am suggesting that for every critical safety email or other electronic message sent, there be a system for verifying that it was received by the correct people and properly acted upon.

News and information about crew, passenger, aircraft and airport security issues.

Are Your Safety Messages Getting Through to Your Employees?

Simply "sending an email" is usually not nearly enough to ensure vital safety information is received - and acted on.

2024 Corporate Aviation Leadership Summit

Charles Alcock

News about significant aircraft accidents and information from accident reports.

News and information on safety procedures and concerns.

News and issues relating to international air transport and cargo carriers, national airlines and regional airlines, including aircraft, engines, personnel, acquisitions, accidents, safety, security and training.

News and issues relating to business, corporate and private aviation, primarily regarding turbine-engine-powered airplanes and helicopters. Subjects include aircraft, engines, maintenance, operations, personnel, acquisitions, accidents, safety, security, and training.

Security consultants are warning clients to increase vigilance

Aircraft Operators Face Rising Threats in Gulf and Russia

Jeremy Kariuki

A recount of the days following the 9/11 terror attacks

Thinking on the fly: Unprecedented times, leadership during 9/11

New developments at airports including regulations and noise issues; legal disputes; openings, acquisitions and mergers.

Russia widely believed to have gotten an explosives-carrying drone into the German airport

Leipzig Drone Threat Raises Security Risk in Europe

Charlotte Bailey

Essential news and analysis on the defense aerospace business. Your trusted source for new and ongoing programs and requirements in military aircraft (manned and unmanned), engines, avionics, weapons and associated systems, including ground-based air defense.

More In Security

Aircraft Operators Face Rising Threats in Gulf and Russia

Security consultants are warning clients to increase vigilance

Thinking on the fly: Unprecedented times, leadership during 9/11

A recount of the days following the 9/11 terror attacks

Leipzig Drone Threat Raises Security Risk in Europe

Russia widely believed to have gotten an explosives-carrying drone into the German airport

Canada Targets Increased Domestic Defense Production

Saab offers Gripen with future fighter choice still to be decided

Air Chiefs: Allied Integration Essential as Threats Intensify

Evolving threats demand deeper multinational cooperation

Boeing Offering Cyber Protection with SkyGuard Service

Digital twin technology eliminates the need for physical access to the aircraft

TSA Urges Operators To Prep Pax during FIFA Traffic Surge

GA has faced Real ID compliance challenges

Security Specialist Warns of Bizav Cyberattack Threats

Cyviation said small operators need more help to be protected

AIN Products

SUBSCRIPTIONS

RESOURCES

ABOUT AIN