Aviation, Maritime, and Transport Security: Protecting Passengers and Critical Transport Infrastructure

Global Tourism Forum Annual Meeting 2026, Brussels

By Nick Careen, IATA's Senior Vice President, Operations, Safety & Security

Good afternoon.

Europe's tourism economy runs on trust.

Trust that when you board an aircraft, it's safe.

Trust that the airport, airspace, border systems and digital infrastructure behind your journey will work.

And trust that when something does go wrong, the system can respond quickly and recover.

Security gives travelers confidence. Confidence supports connectivity. And connectivity is fundamental to tourism.

For decades, when people thought about aviation security, they thought about the checkpoint: screening passengers, baggage and cargo before they entered the secure aviation system. We still need to do those things and do them well.

But some of the most serious threats aviation faces today will never walk through a security checkpoint.

• In December 2018, reported drone sightings shut down Gatwick's runway. Around 1,000 flights were affected, along with more than 140,000 passengers.
• In 2024, interference with global navigation satellite systems (GNSS) meant Finnair had to suspend flights to Tartu, in Estonia.
• And in September last year, a cyberattack on a check-in system provider disrupted several European airports, including here in Brussels.
• Recent days have brought further disruption. More than 25 flights across Europe have been targeted by hoax bomb threats sent by email. Aircraft have been diverted. Fighter jets have been scrambled. Thousands of passengers have been delayed.

Four very different examples. But they all tell us the same thing. Protecting passengers now depends on much more than the airport checkpoint.

I'll speak from aviation's perspective. But our colleagues in maritime and other transport face many of the same threats, and we should be learning from each other rather than learning every lesson separately.

I believe Europe needs to focus on three things.

• First, governments and industry need to work as one team.
• Second, security needs to become more risk-based, so it can keep pace with evolving threats.
• And third, where security already meets the same standard, Europe should recognize it rather than repeat it.

First: One Team

Let me start with working together.

No single organization can protect the journey on its own. Airlines don't control airspace. Airports can spot a drone, but it's usually the police or the military who have the power to stop it. Governments hold threat information that airlines need. And airlines, flying around the clock across the world, often see problems emerging before anyone else does.

These hoax threats show what happens when those pieces sit apart. Most of the threats were not sent to the airlines operating the flights. They went to airports and ground service providers. So the organization best placed to assess whether a threat to an aircraft is credible was often not the first to know about it.

The same need for coordination applies to drones. In February this year, the European Commission set out a plan to deal with drone threats to airports, ports and other critical sites. That's welcome.

Drone incursions have become much more frequent. More than 200 were reported within NATO airspace between January 2025 and October 2026, affecting at least 21 of NATO's 30 European members.

But when a drone closes an airport, the questions become practical very quickly. Who's in charge? Who tells the airlines what's happening? And when is it safe to start flying again?

Airlines bear the cost of diversions, cancellations and support for stranded passengers. They need a clear role in planning the response, and the costs of disruption should be a shared responsibility.

We are not asking for airlines to take over the job of the police or national security services. We are asking that the people running the flights are part of the decisions that affect them.

The same goes for conflict zones.

Europe has built something valuable here. After MH17, the EU set up a system that brings governments, EU institutions and the European Union Aviation Safety Agency together to assess risks in conflict zones and warn airlines.

But when airspace closes suddenly, a warning is only useful if it reaches airlines quickly and clearly enough for them to act on it.

So, our first ask is simple: set up permanent, reliable ways for governments and operators to share threat information, decide together where it makes sense, and get services back up safely.

Second: A Risk-Based Approach

That brings me to my second priority.

Threats are changing faster than the rulebook. Therefore, security has to become more risk-based.

When a new threat appears, the instinct is to add another rule. But piling rule on rule doesn't always make people safer. It can spread effort thinly and leave less attention for the risks that matter most.

These hoax threats show why that matters. Airlines have long-established procedures for assessing bomb threats.

Is the threat specific? Is it credible? What does it tell us about this flight, this route, this aircraft? That assessment helps determine a proportionate response, including whether a search is needed or operations can safely continue.

But when a threat reaches an organization without an established assessment process, it can trigger disruptive action before the airline has had the opportunity to assess it.

Disruption is exactly what the people sending these emails want. A hoax takes little effort. The consequences can cost passengers, airlines and governments a great deal. If every anonymous email triggers the maximum response, we risk giving those responsible the outcome they seek.

Threats to aircraft must therefore reach the operator quickly, so they can be assessed and the response coordinated with the relevant authorities. The response should reflect the assessed risk.

A risk-based approach goes beyond asking, "Have we followed every procedure?" It also asks, "Do we understand our risks, and is our protection actually working?"

For airlines and airports, Security Management Systems help answer those questions. Operators identify the threats and weak points specific to their operation, assign clear responsibility, check whether their protection works and keep improving it.

This doesn't replace regulation; it strengthens how we meet it.

Where an operator can show it manages risk well, governments should recognize that in how they oversee it. The focus should shift towards whether security works, not only whether every box has been ticked.

This matters most when a new threat emerges. Sometimes governments have to act fast, and we understand that. But operators who understand their own risks can quickly tell whether a new measure will work in practice. Talking to them before it's finalised doesn't have to slow things down. It makes the measure better targeted, easier to put in place and less likely to cause problems nobody intended.

Consultation is not a request for a veto. It's a chance to spot the practical problems before they reach passengers and staff.

So, our second ask is for governments and regulators to recognise operators with mature, risk-based security management and consult industry before deciding on new measures.

Third: Recognize, Don't Repeat

The third priority is simple: recognize good security, don't repeat it.

Europe has already shown how. Under One-Stop Security, the EU accepts that certain countries, including the United States and Canada, screen to an equivalent standard. So, passengers and bags that have already been screened there don't have to go through it all again when they connect in Europe.

The protection is recognized, not repeated. Europe should build on that.

Within the EU, when individual countries add their own extra measures, we risk a patchwork where there should be one common system. Sometimes an extra measure is justified by a specific threat. When it is, it should be coordinated and reviewed, not left in place indefinitely.

Beyond Europe, recognition should work both ways. Europe should seek the same recognition from trusted partners, particularly the United States, based on the same security outcome rather than identical procedures. Different doesn't mean less secure. And Europe will carry more weight if it negotiates as one, not country by country.

The wider journey also depends on effective border systems. Europe is right to modernize its borders. But the new Entry/Exit System must work when thousands of passengers arrive at once, not only during testing. Persistent outages, inadequate infrastructure and long processing times are still causing problems in several Member States.

Flexibility should remain available until the system is demonstrably stable and operations have returned to normal. Before the winter season, authorities and industry should agree clear performance standards and measurable benchmarks, including acceptable and maximum waiting times.

The answer isn't to abandon digital borders. It's to test them properly, staff them properly, and involve the airlines and airports that have to make them work.

The same lesson applies to ETIAS, Europe's new travel authorization, which is still to come. Airlines will have to check passengers' authorisation before departure, so they must have reliable access to the information needed to carry out those checks.

Digital identity offers another way to make the journey smoother. Passengers can choose to use their digital identity or continue using a physical passport and boarding pass.

The recent IATA Global Passenger Survey shows that 78% of respondents are willing to use digital biometrics. But the Digital Omnibus proposal could stand in the way. The current legal text risks limiting the use of digital biometrics, despite the benefits they could bring to passengers, airlines and airports.

Done well, digital identity takes "recognize, don't repeat" to the passenger. People prove who they are once, rather than over and over again.

So, our third ask: where security already meets the same standard, within Europe and with trusted partners, recognize it rather than repeat it.

Conclusion

Ladies and gentlemen, Europe doesn't lack security rules. The challenge is that today's threats move faster than the rules, and they cross every boundary we've drawn.

A drone doesn't care which authority is in charge. A cyberattack doesn't stop at one company's systems. GNSS interference doesn't respect a national border.

Passengers shouldn't need to know who holds the threat information or who leads the response. They should be able to trust that we've worked that out together.

So, three asks.

• Work as one team, so the right information reaches the right people in time.
• Make security more risk-based, drawing on operators' expertise to assess threats and shape effective measures.
• And where security already meets the same standard, recognize it rather than repeat it.

Get this right, and we protect the trust that keeps people traveling. The time to put these measures in place is before the next incident, not after.

Thank you.