On October 5, the second day of the international conference “North America/Europe Airport Issues Conference,” organized by the International Association of Airport Executives (IAAE), took place at the Hilton Hotel in Prague. The extensive program of the three-day conference features up to 10 panels, with dozens of speakers from a diverse international backgrounds. Top aviation industry leaders from Europe and North America discussed a wide range of topics related to civil aviation yesterday, including security issues. The CZ DEFENCE editorial team also covered the panel discussion on civil airport security in the context of hybrid threats.

The second day of the conference was opened by Nicholas Merrick, the U.S. Ambassador to the Czech Republic, who drew parallels between current challenges in air transport and ongoing geopolitical shifts. In his speech, Merrick emphasized that, just like air travelers, society itself naturally seeks an environment that is “simple, safe, and comfortable.” However, ensuring these qualities is becoming increasingly difficult for governments and private companies today, as the cost of achieving the desired stability and peace has risen significantly in recent years. He was clearly referring to the deteriorating Euro-Atlantic security environment, after which he highlighted the importance of strong transatlantic ties, which, in his view, have made it possible to create “one of the safest systems in the world.”

Rafael Schvartzman, Regional Vice President for Europe at the International Air Transport Association (IATA), then delivered the keynote address, in which he highlighted the most serious challenges facing the European aviation sector. According to Schvartzman, one of the significant and persistent constraints is the fragmentation of air traffic management into separate national control systems. This fragmentation leads primarily to the inefficient use of already limited air traffic capacity, which significantly contributes to the congestion of European airports.

It is worth noting that, in this regard, a certain parallel can be drawn with the European defense sector, even though the two fields are distinct from one another. For the European defense industry as well, its fragmentation represents a fundamental structural constraint that leads to the inefficient use of available capacities. The keynote speech, therefore, conveyed an important message not only for civil aviation. Schwartzman’s call for deeper integration and the creation of a “Single European Sky” also carries symbolic significance for the defense sector.

In the context of the subsequent panel discussions, the panel titled “Hybrid Threats & Aviation Security: Protecting Airports in a New Risk Environment” particularly caught our editorial team’s attention. The moderated debate featured Aksam Aboasali, a civil aviation expert from the technology company Genetec; Byron Amos, a member of the Atlanta City Council; Patrick Humme, IT Security & Information Security Officer at Vienna International Airport; and Amy Olsen, a representative of the U.S. Transportation Security Administration (TSA). However, the panel also had a Czech connection in the form of Václav Řehoř, director of URC Systems, a company specializing in advanced anti-drone protection for airports and critical infrastructure.

The importance of this topic was underscored by its timeliness, particularly in light of Russia’s intensifying hybrid activities. It is not only Russian hybrid attacks that are often directed at the critical infrastructure of European countries. Airports, however, represent the most complex elements of critical infrastructure, which places special demands on their security. Moreover, the recent incident at Leipzig Airport only confirms that hybrid attacks on infrastructure do not occur solely in the cyber domain. Hybrid attacks can also take the form of kinetic strikes, for example, using drones.

But what exactly are hybrid threats and attacks? Despite their frequent use in official documents and public debate, these terms have been heavily criticized by the academic community due to the unclear content and boundaries of the concepts. The panel discussion therefore began with this very topic.

Amy Olsen confirmed that hybrid threats can indeed take many different forms and are not limited solely to the aforementioned cyberattacks and drone incursions. According to her, the essence of hybrid threats lies primarily in the combination and interconnection of various tactics, techniques, and procedures that have historically been viewed as separate. It is typical for an attacker to exploit existing “gaps” in the security system. Such gaps can take the form of an inadequately equipped legal framework for countering hybrid threats, or vaguely defined responsibilities and cumbersome coordination among individual institutions and agencies when confronting a hybrid attack. “What makes hybrid threats so attractive to adversaries is the existence of numerous vulnerabilities that can be exploited,” summarized the TSA representative.

Václav Řehoř, former CEO of Prague Airport, also shared his perspective on weaknesses in airport security. “There are several of them. I definitely see a weakness in the fact that we’re far too slow when it comes to anything complicated. We’re used to discussing everything at length. We don’t take action […]. But we have to act quickly,” Řehoř urged. In connection with these vulnerabilities, the director of URC Systems further emphasized the need for a comprehensive airport security strategy and thorough security assessments (for more on these topics, see the interview below – editor’s note).

Aksam Aboasali of Genetec, a company that develops security software and hardware, focused primarily on how to protect the airport itself from hybrid attacks. Aboasali pointed out that the digitization of airports creates new dependencies. Common systems – such as baggage check-in, traffic control, flight information, and access control – are thus becoming increasingly interconnected. Consequently, a failure or attack on a single system can impact the operation of the entire airport.

According to him, the solution cannot be the isolated protection of individual technologies, but rather integrated security risk management and the ability to monitor the situation as a whole. He cited, for example, the airport crisis and command center as an important tool, as it can consolidate information from various areas and enable a rapid response.

After the panel discussion ended, we asked Aksam Aboasali the following question: We discussed the incident in Leipzig and the drones that now pose a significant threat to European airports. In your opinion, how should European airports respond to this type of kinetic threat? And what do you think are the most important measures that need to be taken to minimize the likelihood of such attacks occurring?

“We don’t have to look at this solely from the airport’s perspective. Airports should certainly be part of the state’s strategy in this area. Even so, it’s important to emphasize that an airport is not a defense entity but an operational body – or rather, an operational facility. We therefore need to ensure that airports continue to operate and do so as efficiently as possible. This will depend on the specific relationship between the airport and the state. I’ve seen cases where, at some airports, the airport itself can take the lead and exercise a certain degree of control in this regard. Other airports, however, leave this matter to the government or the military. It therefore depends on the role the airport plays in this system.

At the same time, airports are trying to use technology to maintain an overview of what we call flight zones. After all, a breach does not necessarily have to occur directly at the airport’s physical security fence – it can happen even before that, for example, within a designated flight zone. This process can also be automated. Technology can help automatically monitor these zones and provide the necessary information about them.

In addition, technology makes it possible to identify drones through what is known as Remote ID, a system that transmits information about drones. If an airport is able to receive this information, it can use it to assess whether the drone is known or potentially dangerous and take appropriate action accordingly. It can even initiate appropriate procedures in response to this type of threat. In short, it involves coordination between the airport and the relevant authorities, the use of new technologies to gain situational awareness, and the establishment of procedures for resolving individual incidents,” Aboasali told our editorial team.

Airport security, however, also depends on the security of supply chains. As Patrick Humme pointed out, the very fact that multiple actors are involved in the supply chain poses certain risks and vulnerabilities for customers. Each individual part of the chain represents a potential target for an attack.  “So if, as a company, you want to properly prepare for this type of scenario – or any type of hybrid threat – in my opinion, the most important thing is to understand what your key business processes are. If you know what they are, then you know your dependencies,” said the representative of Vienna Airport. “And hybrid threats are precisely about dependencies in increasingly interconnected systems,” concluded Humme, recommending that every airport ask itself how long it can operate safely if one of its critical suppliers ceases to function as a result of a cyberattack.

On behalf of the CZ DEFENCE editorial team, we subsequently had the opportunity to ask URC Systems Director Václav Řehoř a few questions as well:

Airports are among the most complex elements of critical infrastructure. In your opinion, which hybrid threats pose the greatest risk to European airports today, and how has the security environment changed significantly compared to previous years?

In my view, the biggest change is the fact that individual security threats are increasingly intertwined. It is no longer possible to address airport physical security, personnel security, cybersecurity, or the threat posed by drones, for example, in isolation. A hybrid attack can combine several of these elements simultaneously.

The first key factor is the changing geopolitical environment. We must view European airports not only as transportation infrastructure but as strategic critical infrastructure. This brings with it the risk of sabotage, intelligence activities, information and psychological operations, and other forms of hybrid operations.

It is important to realize that psychological and information operations are not primarily directed at the adversary’s military strength, but at society – its emotions, symbols, trust in institutions, and way of life. From this perspective, state leaders, national airlines, and critical infrastructure hold extraordinary symbolic value. Airports are particularly vulnerable in this context. They symbolize mobility, a country’s openness, and its connection to the world; at the same time, they are places where a relatively minor incident can trigger a significant media, economic, and psychological response. The goal, however, need not be the physical destruction of the airport. Simply disrupting operations, creating a sense of uncertainty, and undermining public confidence in the state’s ability to protect its critical infrastructure can be sufficient.

The first area I consider exceptionally significant in this context is the “insider threat” – that is, the exploitation of individuals who work at the airport or have authorized access to it. A modern airport is a vast ecosystem in which thousands of people work for the airport, airlines, ground handling companies, catering services, maintenance crews, security services, and dozens of other contractors. A person with legitimate access may be familiar with processes, infrastructure vulnerabilities, and security protocols. When combined with a cyberattack or physical sabotage, an insider can therefore pose an extremely serious risk.

The second significant area is cyberattacks. The digitization of airports has significantly increased their efficiency, but at the same time has created new dependencies. An airport is interconnected with airlines, ground handling providers, air traffic control, government agencies, and external suppliers. An attacker, therefore, does not need to target the airport directly. They can exploit a vulnerability in any link of the supply chain and use it to disrupt operations.

The third area is drones. However, I would not view them as a separate security discipline. They are part of the physical security of the airport and its perimeter; they simply add another dimension. They can be used for reconnaissance, disrupting operations, transporting cargo, or as a means of attack. Counter-UAS must therefore be part of the overall physical security system of the airport, not an isolated technological solution.

The fundamental change in the security landscape, therefore, lies in the fact that the boundaries between physical, personnel, cyber, and information security are gradually blurring. The answer, therefore, must be an integrated security concept.

Physical and cyber threats are becoming increasingly intertwined. In your opinion, what should truly resilient airport security look like – one that can integrate these areas into a single security concept?

The foundation must be a comprehensive airport security strategy based on risk analysis that integrates physical security, personnel security, cybersecurity, protection of communication and information systems, drone defense, and crisis management.

However, it is not enough to simply have individual security systems. The key is to integrate them at the operational level. That is why I consider it essential to establish a unified security and situation center, where a shared situational picture is formed and from which the response to an incident can be coordinated. Information from CCTV systems, perimeter security, access control, radars, RF detection, drone detection systems, cyber monitoring, and other sources must be able to create a single, comprehensible situational picture.

But technology is only one part of the solution. It is equally important to determine in advance who evaluates the information, who makes decisions, and who carries out the response. During an actual incident, there is no time to start sorting out the responsibilities of individual institutions. Therefore, there must be systematic cooperation between critical infrastructure operators and state security agencies. And in the current security environment, I would go even further. This architecture must also be integrated with the state’s defense system, including the military.

A hybrid conflict can indeed escalate. A situation that begins as a cyberattack, sabotage, or a series of incidents targeting critical infrastructure can evolve into a serious threat to national security or defense. If the legal conditions are met, the military may also be involved in protecting strategic critical infrastructure.

Therefore, cooperation cannot begin only when a crisis strikes. Airports, the police, security and intelligence agencies, the military, air traffic control, and other relevant institutions must have predefined communication channels, responsibilities, and cooperation scenarios. And they must also test them together. It is not enough to practice responding to individual incidents. It is necessary to simulate combined scenarios, such as a simultaneous cyberattack, a perimeter breach, the presence of drones, an information operation, and suspected insider involvement.

In my view, an airport’s true resilience therefore stems from a combination of a comprehensive security strategy, shared situational awareness, clear responsibilities, and a coordinated response by the airport and state security agencies – with the option to involve the armed forces in the event of an escalation and under conditions established by law.

From your previous position as CEO of Prague Airport, you’re familiar with these issues from an operator’s perspective; today, you’re addressing them from the perspective of the technology company URC Systems. Where do you think the biggest gap exists today between what airports need for their security and what governments and the security industry are actually able to offer?

It is precisely my experience from both sides that shows me that the biggest gap today isn’t necessarily in the technologies themselves, but in their integration and in linking technologies to processes, competencies, and decision-making.

The security industry can offer highly advanced technologies. We can detect drones using various types of sensors, monitor the radio spectrum, utilize radar, RF, and EO/IR systems, analyze cyber threats, and increasingly leverage artificial intelligence to evaluate large volumes of data.

However, an airport operator does not need ten additional screens and ten isolated systems. They need to know what is happening, how serious the threat is, and what to do at that moment. This is particularly evident in the case of drones. Technology can detect a drone, classify it, and in some cases even locate its operator. But the problem does not end there. Much more complex questions follow: Who decides whether it poses a threat? Who is authorized to intervene? What kind of intervention is permissible in a civilian airport environment? Who decides to restrict or suspend operations? How quickly does the information reach the police, air traffic control, and other agencies?

From the perspective of a technology company, I therefore see another significant gap between the pace of technological development and the pace of legislative and institutional change. Technologies such as electronic warfare, RF detection, counter-UAS, and – for example – GNSS jamming and spoofing detection are evolving very rapidly. However, civil airports operate in a strictly regulated environment, and some technologies that are commonly available in the military sector cannot simply be transferred to the civil sector.

And this is precisely where I see the greatest challenge for the future. We must bring together the expertise of critical infrastructure operators, law enforcement agencies, the military, and the technology industry when designing the security architecture – not just when responding to a specific incident. In my view, airports do not need additional isolated security technologies. They need an integrated resilience architecture that connects technologies, people, information, decision-making processes, and government accountability into a single, functional system.