DOT Rule Lets Compliant Airlines Withhold Meals and Hotels After Cyberattack Delays
Summary
A new DOT rule classifies cyberattacks as uncontrollable flight disruptions for compliant airlines, removing meal and hotel obligations while creating a separate tracking category. Consumer groups raised concerns about accountability and potential ambiguity.
Key points
- The DOT rule treats cybersecurity attacks as “not controllable” disruptions when airlines comply with applicable cybersecurity regulations.
- Compliant airlines may not have to provide meal vouchers or hotel stays for cyberattack-related delays or cancellations.
- The rule establishes a separate reporting category to track these flight disruptions.
- FlyersRights criticized the change and urged stress testing of airline computer systems; the National Consumers League expressed both support for clearer rules and concern about reduced airline responsibilities.
- The rule stems from the FAA Reauthorization Act of 2024, and the Aviation ISAC welcomed its incident-reporting provisions.
- The article says there is no formal accounting of how often cyberattacks have led to delays or cancellations that prompted airlines to provide amenities.
Article Details
- Event Type
- The Department of Transportation published a rule classifying qualifying cybersecurity attacks as “not controllable” flight disruptions and establishing a separate reporting category for them.
- Impact
- Airlines that comply with applicable cybersecurity regulations may not be obligated under their customer service plans to provide meal vouchers or hotel stays for delays or cancellations caused by cybersecurity attacks. The rule also aims to improve tracking of these disruptions. FlyersRights criticized the change, while the National Consumers League and Aviation ISAC expressed mixed or supportive views on aspects of the rule.
People
Jeff TroyPresident and CEO of the Aviation Information Sharing Analysis Center, which supported the rule’s incident-reporting elements.Joe BidenSigned the FAA Reauthorization Act of 2024, from which the rule stems.John BreyaultVice president of public policy for the National Consumers League; discussed potential consumer effects and compliance conditions.Kate GrowleyPartner at Crowell & Moring who commented on the breadth of the rule’s cybersecurity-regulation language.Paul HudsonPresident of FlyersRights; criticized the change and said the group had urged stress tests for airline computer systems.Sophie HayashiCounsel at Crowell & Moring who described the implications of the rule for airline customer-service obligations.
Industries
AirlinesThe Transportation Department will let airlines with compliant cybersecurity programs avoid providing meal vouchers or hotels when flights are delayed or canceled by cybersecurity attacks.AviationThe new rule also creates a separate delay-tracking category for these incidents, while drawing mixed reactions from consumer advocates and aviation security groups.