The articles I've read said indicate that a "Taxi Capable" employee would be empowered to start up the aircraft, so it's not even clear whether security precautions would be relevant here.

Seems that it should be a two-level interlock, as is found on some high-end sportscars. The regular key allows for regular driving, but the Valet Key limits it to just over walking speed -- obviously sufficient to park & retrieve, but no good for joyriding.

I'm quite surprised that this was overlooked in post-9/11 security reviews.

I'm surprised that taxi capable employees are left by themselves to do this kind of work. This could've been preventable had there been a second person in the cockpit as well.

Does this second person live in the cockpit 24/7? This guy got in an unoccupied plane.

Do programmers just ship code to production without a second person to review code?

You probably don't want to hear the answer to this one.

All the fucking time. While there is an attempt to avoid and standard deployment procedures hopefully. Sometimes in an emergency you just get shit done and fixed for a client. I heard a mantra regarding this from a pretty big consultant at a major company: be bold be brave, deploy

I guarantee your financial information has passed through that product.

Are all peer reviews/pull requests equal?

A lot depends on the size, maturity, and customers of the group shipping code. One-person side/hobby projects wouldn't have a 2nd person to review the code. A previous employer initially had a "Deploy to Production" script that ran every 60 seconds, copying the Development folder to the Production folder - to make easier their testing in Prod.

But large publicly-held companies with more customers will often have auditors that require better controls over dev/test/UAT/Prod, and between developers and operators. Separation of Duties is essential to protecting Business Operations from disruptions caused by a single individual.

There should be some sort of lockout that requires 2 humans to put an airplane in the air - at least for major airlines, and could be mandated by law. This could range from a 2-key fuel shutoff for the engines, to different keys on the outer plane door and the inner cockpit door, to mandatory wheel boots on idle airplanes. And part of this would be a very good key management system, possibly with many physical keys managed by an airport or airline "key desk" - or maybe through electronic key-cards, RFID chips or key-fobs, or a smartphone app.

And even at Large publicly held companies the guy trying to implement a fix that matters is going to over ride those controls and get it out, the auditor might complain later but who cares. I know some devs that will do it at midnight while smoking weed at Fortune 50 companies. Sometimes you ignore the normal process and get it done and basically work around any locks/restrictions

Such lockout systems are a safety risk themselves should they err and limit functionality in the air.

What do you mean "ship" to production? Isn't the normal thing to do to modify the code directly on the production server using FileZilla on port 21?

Yes. My previous job did precisely that.

We were responsible for probably 80% of the academic internet. And those Mloc perl5 programs were terrifying to work with.

Hmm I don't think it's that much of a headache to have some PIN code provided to pilots as an additional measure.

These planes aren't cheap, even a small personal jet is in the low millions. A Boeing 747 or similar is in the hundreds of millions.

Airline engineering employees need to power on planes, fire up various systems to test, and even move them around. It's absolutely routine. All the reports I've seen seem to suggest that this was one of those employees. So it seems reasonable to assume that he would have had the PIN or "key" or whatever in this case anyway.

valet mode for aircraft. of course we can never eliminate the risk but perhaps a two key mode similar to launch controls for missiles to do anything with a plane other than low power movement?

You put so much (undeserved) faith in the missile launching crowd...000000 comes to mind.

Other industries have controls that prevent simple passwords from being used. Who audits the missile control groups?

The all zero thing goes back a while when someone in the military was told to put launch codes in and defiantly made them 0. Because God forbid there should be any protection on the most deadly device ever created by man.

Whatever system that you put in place would have to never (or very close to never) have a false negative during normal aircraft operation.

One other commenter here mentions a simple ignition key would have prevented this incident, but there's been at least one major ignition system flaw in cars that caused multiple deaths ( https://en.wikipedia.org/wiki/General_Motors_ignition_switch... ), and the consequences of a failure causing loss of control to a passenger aircraft far outweighs that in a car.

Given the very low rate of unauthorised takeoffs of passenger aircraft, and that this case was an insider who may have been able to gain access to keys/codes anyway, is introducing introducing a new system to aircraft justified?

Yeah, a freakin _ignition key_ would have made this whole thing impossible.

Unless of course as an employee he had access to one.

Well, require that only pilots have access to the key then.

.. which they will promptly hand over to the engineers for maintenance purposes, just as people do with their car keys.

Create a “valet key” which lets the engineer to do what he/she needs to do but doesn’t allow to take off.

And mechanics.

Or let air traffic control diasable any plane while it’s taxiing.

I’m not sure having a remote control kill switch on an airplane is the kind of backdoor that improve security (if any backdoor can, which I’d doubt).

The current "kill switch" technology for rouge airplanes is an F-18 with a few Sidewinders.

Sounds a lot safer to me and sufficient as well.

That's dangerous. Imagine this remote control gets hacked and planes start getting disabled in mid air, or even while trying to take off.

An hard to copy ignition key makes a lot more sense.