Avi­ation Cy­ber­se­cur­ity and Third-Party Soft­ware Ser­vice Pro­viders: Do Com­pan­ies Like Crowd­Strike Get a Free Pass to Create Cyber Vul­ner­ab­il­it­ies?

De­vel­op­ment sum­mary

Claire Konerza’s Journ­al of Air Law and Com­merce com­ment ad­dresses the grow­ing cy­ber­se­cur­ity risks in civil avi­ation and the part played by third-party soft­ware ser­vice pro­viders in cre­at­ing or mit­ig­at­ing those risks. Using the dis­rup­tion caused by Crowd­Strike’s de­fect­ive soft­ware update in summer 2024 as its point of ref­er­ence, the piece con­siders how far such pro­viders may be held liable beyond con­trac­tu­al limits, and the po­ten­tial harm to air­lines and con­sumers, in­clud­ing fin­an­cial loss and data com­prom­ise.