WASHINGTON — Twenty-five years after hijackers turned four commercial jets into weapons, one of the architects of post-9/11 aviation security is warning that the industry has spent two decades fortifying the wrong perimeter.
In a September 11 anniversary essay for American Thinker, Lt. Col. Arik Arad — former head of El Al security at Ben Gurion Airport and later an advisor to the Governor of Maryland — argues that the TSA checkpoints, reinforced cockpit doors, and hardened terminals built after 2001 defend against a threat model that has since been overtaken by technology.
Modern airliners, he writes, “are no longer just mechanical machines; they are flying data centers.”
A Pattern of Fixing Yesterday’s Attack
Arad’s central charge is not that any specific post-9/11 measure was wrong, but that the entire governing instinct behind them is. American security policy, he contends, has for nearly eight decades operated on a reactive loop: borders get breached before walls go up, aircraft get flown into skyscrapers before cockpit doors get reinforced, intelligence agencies get overhauled only after blood is spilled.
He traces that pattern across aviation history, arguing that in case after case the threat was known and the vulnerability identified long before a catastrophe forced action — at which point the response arrived as a commission, a budget line, and a retrospective fix rather than a preventive one.
The post-9/11 buildup, in his telling, fits the same mold. Washington created the Department of Homeland Security, stood up the TSA, installed reinforced flight deck doors, and “militarized airport checkpoints,” pouring hundreds of billions of dollars into federal agencies. Arad calls those measures necessary — but calibrated to the threat vector of 2001, not the one taking shape now.
He notes the tragic irony that on September 11 itself, simple, low-cost precautions could have changed the outcome entirely.
The Aircraft as the New Attack Surface
The essay’s core argument is that commercial aircraft have quietly become networked systems, and that security thinking has not caught up. Flight Management Systems, electronic flight bags, ground-to-air communications, and onboard Wi-Fi are now deeply integrated into how a modern jet operates.
Regulators, Arad acknowledges, insist that critical avionics are “air-gapped” — physically and logically isolated — from passenger entertainment networks. He is bluntly skeptical, writing that security researchers have repeatedly shown software air-gaps to be “a dangerous illusion.”
He points to state-sponsored actors from China, Russia, and Iran actively probing Western critical infrastructure for zero-day vulnerabilities, and argues that an airborne cyber exploit is no longer a theoretical exercise for ethical hackers. In his framing, it is a low-cost, high-asymmetry weapon suited to modern hybrid warfare — cheap to develop, difficult to attribute, and potentially devastating in effect.
The scenario he sketches is stark: an adversary exploiting a zero-day flaw to corrupt an aircraft’s Fly-by-Wire system mid-flight and override pilot inputs. The resulting panic, loss of life, and economic paralysis, he writes, would mirror the fallout of 9/11 — achieved without a single attacker passing through a TSA checkpoint.
Why Nothing Has Been Done
Arad offers two explanations for the delay, and neither is flattering to the institutions involved.
The first is administrative inertia. Regulators like the FAA, he writes, move at the speed of bureaucratic consensus while technology advances exponentially — a mismatch that guarantees the rules trail the risk.
The second is incentives. When airlines evaluate cyber mandates through the narrow lens of compliance costs rather than national defense, Arad argues, safety ends up behind quarterly profit margins.
He pointedly asks why basic cybersecurity requirements for aircraft systems are treated as optional guidance or slow-walked through the bureaucracy at all.
What He Wants Done
The essay is not purely diagnostic. Arad lists measures he says exist today and could be mandated now: hardware-level encryption on all air-to-ground telemetry; independent mechanical overrides that software cannot bypass; strict air-gap isolation protocols verified by independent cyber auditors; and real-time intrusion detection embedded in onboard avionics.
Responsibility, in his account, falls on Congress, the FAA, and CISA to dictate binding cybersecurity standards rather than voluntary frameworks, and to dedicate targeted budgets specifically to protecting aircraft architecture itself. He frames the spending as trivially small next to the financial, human, and geopolitical cost of even one successful mid-flight cyberattack.
“Securing our skies requires foresight, not hindsight,” he writes, urging both federal officials and airline executives to stop treating cyber protection as a secondary maintenance cost. If action waits for an actual cyber hijack, he warns, the regulations that follow will once again be built on top of a tragedy that everyone saw coming.
Arad’s argument lands in a policy space where jurisdiction is genuinely fragmented — the FAA oversees airworthiness, CISA handles critical infrastructure protection, and airlines own the aircraft — which may itself explain part of the inertia he describes. His credentials give the critique weight: he has testified before Congress on aviation security multiple times and is a frequent television commentator on aviation defense.
Whether lawmakers treat airborne cyber defense as urgent or as one more item for a future commission, his closing line is the challenge: “We know the threat is here. It is time to act before the inevitable occurs.”
Source: www.americanthinker.com — https://www.americanthinker.com/articles/2026/09/securing-the-skies-before-the-next-9-11/