Commercial Aviation: Information on Airline IT Outages
Released: 2019-06-12T00:00:00

Letter

Background

In the U.S. commercial airline industry, passengers travel on network, low-cost, and regional airlines. With thousands of employees and hundreds of aircraft, network airlines support large, complex hub-and- spoke operations, which provide service at various fare levels to many destinations. Low-cost airlines generally operate under a low-cost business model, which typically includes providing point-to-point service using fewer types of aircraft. Regional airlines typically operate small aircraft—turboprops or regional jets with up to 100 seats—and generally provide service to smaller communities on behalf of network airlines.

Airlines rely on a wide variety of IT systems to schedule and transport passengers; some of these IT systems interface with networks operated by travel-booking sites, other airlines, and the FAA. These IT systems touch all phases of a passenger’s travel experience, including booking, check-in, boarding, and baggage, as well as airline operations behind the scene, including flight planning, crew scheduling, and flight dispatch, according to FAA. In addition, aviation stakeholders explained that airline IT systems operate in a dynamic, data-intensive environment that demands around-the-clock availability and real-time information. In recent years, the introduction of new mobile applications and telecommunications infrastructure has added to the myriad systems and network connections now critical to an airline’s operations.

Airlines face challenges in maintaining or enhancing their IT systems. For example, some airlines operate a web of IT systems that were developed over many years as manual systems transitioned to electronic and computer-processed functions. Replacing software and upgrading these older systems, such as reservations and crew scheduling, can be complicated undertakings as airlines serve millions of travelers and need to keep data flowing across their networks. For example, in its financial filings, Southwest pointed to the significant challenges and costs involved in introducing new IT capabilities while managing existing systems. Increasingly dependent on the use of IT systems to run its ongoing operations, the company recently completed a multi-year initiative to transition to a new third-party reservation system through Amadeus, among other investments.

In addition, a wave of industry consolidation stemming from airline bankruptcies in the late 2000s has affected airline IT systems, requiring significant sustained focus among airlines on merging different IT infrastructures necessary to support worldwide flight operations without interruption. For instance, we previously found that United struggled to integrate computer and reservation systems following its merger with Continental in 2010, although the airline has subsequently completed this transition, according to airline representatives. Likewise, in 2015 American pointed to its reliance on technology when discussing principal risks posed by the integration of its computer, communications, and other technology systems with those of US Airways following the merger of the two airlines.

Additionally, some airlines rely on regional partners or third-party IT providers to help manage certain IT systems, such as reservations, crew scheduling, and flight dispatch, further adding to the variety of systems that airlines depend on to run their operations. Moreover, the airline industry is going through a transformation as it shifts to digital merchandizing and retailing to better serve consumers, a process which requires access to real-time information, according to an industry stakeholder. Finally, the speed of technology evolution has accelerated, making it a constant and iterative process to keep systems refreshed and operating in sync, a situation that poses additional challenges, according to a stakeholder.

Passengers may be affected by an airline IT outage in different ways depending, in part, on the type and severity of the outage—for example, whether the outage stems from a software glitch or a hardware failure— and the system affected. (See fig. 1.) Effects can range from standing in line to be checked in by a ticket agent instead of using a mobile application to delayed and canceled flights if a hardware failure forces the airline to ground all of its flights until the system is back online. System failures may have cascading effects across other airline IT systems or operations, as well. For example, an outage in a flight dispatch system could cause hours-long delays for subsequent flights. Likewise, aviation stakeholders noted that crew positioning can hinder recovery from an outage as delayed flight crews “time out,” further extending the effects of an outage. In addition to these effects, passengers and airlines can also face higher costs from delayed or canceled travel, including increased operational expenses facing airlines as crews and aircraft sit idle, as well as indirect costs, such as those faced by travelers as their itineraries are delayed or canceled.

FAA and DOT Have Limited Roles in Overseeing Airline IT Systems and Addressing Effects from Outages on Passengers

FAA’s Role Is Primarily Initiating Traffic Management Initiatives Requested by Airlines

FAA plays a key, but limited, operational role in responding to airline IT outages. As previously noted, FAA is responsible for ensuring the safe, efficient operation of the NAS. Agency officials we interviewed emphasized that airline IT outages have a limited effect on FAA’s management of the NAS because such outages tend to affect the demand for airspace, not its capacity. As a result, FAA officials explained that if flights are delayed or canceled because of an airline IT outage, the NAS is often less congested for those that remain flying.

However, in managing the air-traffic control system, FAA is responsible for initiating and administering traffic management initiatives (such as a ground stop) if requested by an airline experiencing an IT outage. For example, an airline might request that FAA initiate a ground stop if the airline is unable to report flight dispatch information to the FAA, such as the weight and balance of aircraft. FAA works with airlines to accommodate flights back into the NAS when the outage is over. Once an airline recovers from an outage, FAA may also need to initiate traffic management initiatives if demand exceeds capacity in the system— potentially causing delays both for the airline that experienced the outage, as well as others.

FAA does not routinely collect data about airline IT outages—which fall outside of its management of the NAS, according to agency officials— although it does collect data on NAS operations, which could include some information about these events. Specifically:

The National Traffic Management Log (NTML)—the real-time narrative log of NAS traffic management initiatives kept by air traffic controllers—includes information about ground stops or other initiatives such as time the stop was put in place, affected airports, and when the initiative was lifted. Log entries may also include additional information about the outage, if such information is provided to air traffic control by the airline experiencing it.

The Operations Network (OPSNET) system, among others, collects operational data, including air traffic operations and delay data to analyze the performance of the FAA’s air traffic control facilities. However, according to agency officials, data on the effects of airline IT outages (including delay and cancellation data related to airline IT outages) are discarded because information about airline-caused flight disruptions do not provide instructive information to FAA about whether the agency is efficiently operating the NAS.

FAA does not directly oversee airline IT systems related to reservations, check-in, baggage, and boarding or their use, according to agency officials. These systems are managed by the airlines themselves. For airline IT systems that interface with FAA’s operational systems, such as automated systems used in air traffic control, FAA works with airlines to ensure that any output (i.e., data feeds) interfaces correctly with the agency’s systems. FAA may provide observations to the airline if its IT systems are not providing accurate information, such as if crews are not being correctly scheduled and tracked, fuel plans are not accurate, or flight plans are not correctly calculated and observable.

For Passengers, DOT Helps Ensure Compliance with Consumer Protections, Which May Be Triggered by Certain Airline IT Outages

DOT’s Office of the Assistant General Counsel for Aviation Enforcement and Proceedings and its Aviation Consumer Protection Division are responsible for helping ensure airlines’ compliance with passenger protection requirements and educating passengers on their rights. Airline IT outages are not specifically addressed by any of DOT’s consumer protection regulations. Rather, when these outages occur, they may trigger broader consumer protections afforded passengers. For example, airlines are required by DOT’s interpretation of the statutory prohibition on unfair and deceptive practices to provide refunds for flights that are canceled or significantly delayed if a passenger declines any rerouting that the airline may offer. In the case of delay, however, what amounts to a significant delay is not defined in this policy, and as discussed below, individual airlines may or may not set their own thresholds. According to agency officials, DOT is currently conducting a review of air carriers’ handling of involuntary changes to passengers’ travel itineraries. DOT also regulates compliance through its tarmac delay rule, which requires airlines to mitigate or avoid consumer harm in the event of a lengthy tarmac delay. In addition to these consumer protection regulations and policies, DOT oversees airlines’ compliance with obligations included in airline contracts of carriage or customer service plans. These contracts and plans must be publicly posted by airlines on their websites.

As we have previously reported, DOT helps ensure airlines’ compliance with its passenger protection requirements by educating airlines on new regulations or clarifying existing regulations, responding to airlines’ questions, and reviewing airlines’ consumer service policies. According to DOT officials, the agency encourages proactive reporting of incidents by airlines, such as airline IT outages, including a brief description of the incident and any steps taken by the airline to provide accommodation to affected consumers. DOT also receives and investigates complaints from passengers and uses complaint data to identify which airlines to inspect and whether to begin investigations that may result in fines or enforcement actions. According to agency officials, DOT received 126 complaints that explicitly mentioned a domestic airline IT outage from 2015 through 2017. These complaints involved five such outages. For comparison, in all, the agency received between 17,000 and 21,000 complaints per calendar year during that timeframe, according to DOT’s Air Travel Consumer Report. According to DOT officials, complaints that explicitly mentioned an airline IT outage largely mirror in substance those received for other causes of flight disruptions. (These complaints are discussed in more detail below.)

According to DOT officials, no investigations have been carried out focusing solely on airline IT outages, but DOT investigations have included airline IT outages that contributed to violations of DOT’s consumer protection regulations. For example, DOT found that an IT outage affecting Delta’s operational systems, including gate management and flight dispatch systems, caused significant surface congestion and resulted in a violation of tarmac delay regulations. This violation was among those included in enforcement proceedings resulting in a civil penalty and consent order to the airline.

Finally, to monitor airline on-time performance and baggage handling and to provide information to consumers, DOT requires certain airlines to report data to BTS monthly, including the causes of flight delays and cancellations. However, the causes are grouped into broad categories and do not specify IT outages as a cause. BTS, which is an independent statistical agency within DOT, publishes summary data from reporting air carriers on the number of domestic on-time, delayed, canceled, and diverted flights on its website. DOT’s Office of Aviation Enforcement and Proceedings also publishes a monthly Air Travel Consumer Report with this information. We discuss these data in greater detail below.

Information on Airline IT Outages and Their Effects Is Limited, but Suggests That Outages Result in a Range of Passenger Inconveniences

We Identified 34 IT Outages Affecting Almost Every Domestic Airline in Our Review

Using a variety of information sources, we identified 34 airline IT outages from 2015 through 2017 affecting 11 of the 12 airlines in our review. No government data, academic literature, or other information source could be used to determine a comprehensive count of airline IT outages, and information is also limited regarding the types, causes, and effects of these incidents. Additionally, airlines do not regularly share detailed data about their IT outages publicly, such as the number of flights or passengers affected or the technical cause of the outage, although general information about these incidents is sometimes provided on their websites and social media accounts or to the press.

To identify airline IT outages in the absence of other sources of information, we validated a preliminary list of outages developed through a review of open source information, including media coverage. This preliminary list was validated through a combination of interviews with the airlines and third-party IT providers and a review of publicly available airline information, FAA NTML log entries, and DOT consumer complaints. Through our validation process, airline representatives and others identified additional airline IT outages that had not been reported or acknowledged publicly by airlines or third-party IT providers, reflecting the variation in quantity or quality of information available regarding these events. For example, we found more information about IT outages that had nationwide or multi-day consumer or operational effects because these incidents garnered more coverage—and often an official airline response—as compared to those that were of shorter duration or affected a regional carrier or smaller number of flights, passengers, or airports. Additionally, we found less or incomplete information on outages at third- party IT providers and regional carriers because their effects were dispersed across multiple airlines.

We found that the number and severity of flight disruptions associated with the airline IT outages we identified varied widely. About 85 percent (29 of 34) of our identified outages resulted in some flight disruptions, including 5 outages we identified that caused over 800 delays or cancellations. However, we were unable to verify the exact number of disrupted flights caused by each outage. At least 14 outages resulted in a ground stop, some of which lasted for several hours, according to a review of FAA’s NTML logs. We identified seven outages that had no associated flight disruptions, although they inconvenienced customers in other ways. For example, during these incidents customers experienced problems buying tickets online, checking into flights on an airline’s website, or using frequent flier benefits.

Because no comprehensive data are available on airline IT outages and their related effects, we could not compare these incidents with the effects on flights caused by other disruptive events, such as severe weather like hurricanes or snowstorms. However, FAA analysis of two of the IT outages that caused over 800 flight disruptions found that the number of delays or cancellations resulting from these outages was on par with or worse than those caused by severe weather in the same months the outages occurred. Likewise, representatives from one airline stated that operational effects from airline IT outages are comparable to severe weather events, although outages occur much less frequently. An aviation industry representative noted that these events are typically unexpected, hindering the ability of airlines to react and recover. By contrast, disruptions from weather may be forecast ahead of time, allowing airlines to prepare for predicted disruptions, including accommodating customers, adjusting flight crews and schedules, and pre-positioning aircraft, according to the same representative.

The airline IT outages we identified were caused by a range of IT and infrastructure issues, according to airline representatives we interviewed and official press statements. These issues included hardware failures, software outages or slowdowns, power or telecommunications failures, and network connectivity issues, among others. In several instances, an IT issue in one airline system had cascading effects across other systems not affected by the initial outage. For example, a large volume of online traffic shut down an airline’s website and subsequently disrupted the airline’s reservations and check-in systems. Representatives from six airlines, an IT expert, and four other aviation industry stakeholders pointed to a variety of factors that could contribute to an outage or magnify the effect of an IT disruption. These factors ranged from underinvestment in IT systems after years of poor airline profitability, increasing requirements on aging systems or systems not designed to work together, and the introduction of new customer-oriented platforms and services.

Representatives from airlines we interviewed also described some of their IT system investments and risk mitigation efforts undertaken in response to an outage or to address potential disruptions, such as investing in new backup systems or technologies. For example, five airlines have sought to reduce vulnerability by expanding IT operations beyond a single data center or moving them to the cloud, which allows for the delivery of computing services through the Internet. Likewise, two airlines described efforts to ensure connectivity and reduce the effects of IT disruptions by using multiple telecommunications network providers. Several airline representatives and an IT expert said that these airline IT investments are aimed at enhancing overall system functionality as well as revenue. However, the IT risk expert we spoke with noted that carrying out major upgrades to their IT systems can be challenging because these systems are always in use. Additionally, according to stakeholders we interviewed, airlines employ a variety of contingency planning and recovery strategies to respond to unforeseen technical issues, including IT outages. For example, one airline described incorporating routine system testing, artificial intelligence, and outage drills into planning for system disruptions to avoid outages or speed recovery. Airline efforts to increase the resiliency of their IT systems, such as those described above, could prevent or lessen the impact of such outages.

BTS Data Broadly Capture Flight Delays and Cancellations

BTS data capture the causes of flight delays and cancellations in several broad categories, which do not isolate flight disruptions resulting from airline IT outages and do not reflect the root cause of flight disruptions. As previously mentioned, BTS collects on-time performance data from the airlines, including the causes of flight delays and cancellations. On a monthly basis, certain airlines are required to report at least one cause of delay (in minutes) for each flight delayed 15 minutes or more from the following five categories: air carrier, extreme weather, NAS, security, and late arriving aircraft. Similarly, for each flight that was canceled, airlines are required to report the cause from one of four categories: air carrier, extreme weather, NAS, and security. BTS guidance instructs airlines to report flight delays that are within the control of the airlines in the air- carrier category. Also included in the air-carrier category, according to the guidance, are more than 40 other potential causes of delays or cancellations, such as aircraft maintenance, baggage, terminal operations, and crew matters. As a result, flight disruptions from IT outages are indistinguishable from other airline-caused issues within this category.

Additionally, delays caused by airline IT outages may be captured in a category other than air carrier because of how airlines can report the causes of flight delays based on BTS guidance. For example:

Multiple causes for a delay. Airlines have the option to report either just the main cause or all the causes for a flight delay as long as the airline consistently applies the same method in its monthly report to BTS. Also, if there is more than one cause for a flight delay that starts at the same time, airlines are required to report the cause that lasted the longest. As a result, delays caused by an airline IT outage may be attributed to other categories if they happen at the same time as other issues affecting an airline’s operations, such as poor weather or airport conditions.

Late arriving aircraft delays. Airlines can report a flight delay in the late arriving aircraft category if the previous flight arrived late and caused the next flight (on the same aircraft) to depart late. Airlines are not required to provide additional information on the cause of the delay for the previous flight (air carrier, NAS, security, or extreme weather). As a result, delays from incidents that can cause ripple effects on an airline’s operations, such as an IT outage or severe thunderstorms, may be attributed to the late arriving aircraft category.

NAS delays. Airlines can report delays in the control of the FAA, airport operators, or state and local officials in the NAS category, which includes ground stops, flight volume delays, and air traffic control issues, among others. However, BTS guidance does not specify how airlines should report delays caused by ground stops requested by the airlines, including after an IT outage. As a result, these delays may be captured in the NAS category.

BTS data are collected to provide general information on the quality of airline performance to consumers and to improve airline scheduling, rather than detailed information about specific flights or events.

Consequently, these data provide limited insight into the effects of individual events, including airline IT outages, both because flight disruptions may be captured in more than one category and because the data do not allow for the isolation of effects for affected flights.

We reviewed BTS data for most of the airline IT outages we identified and found, for example, that for 3 outages, airlines reported the largest total number of flight delays in the NAS causal category on the day that the airline requested a ground stop because of the outage—rather than in the air-carrier category. In addition, we reviewed BTS data for the 5 outages we identified where the airline involved delayed or canceled at least 800 total flights and found that airlines spread the causes of flight delays and cancellations across several categories, primarily air carrier, late arriving aircraft, and NAS for the first day of these outages. For example, we found that airlines attributed 44 percent of all reported flight delays to late arriving aircraft for these days. (See fig. 4).

DOT officials did not see a need for additional reporting requirements on flight delays and cancellations caused by airline IT outages given the effects of such events are not unique when compared to other causes of flight delay and because these incidents involve a small portion of consumer complaints received by DOT. Aviation stakeholders we spoke to told us that airlines track flight disruptions for internal purposes such as managing operations and scheduling. For example, representatives from one airline said that the airline tracks delays and cancellations associated with IT outages and other issues internally to identify patterns and reoccurring issues that need improvement, such as scheduling, staffing, and maintenance. DOT officials noted that obtaining more detailed information on the causes of flight delays and cancellations would require a cost and benefit analysis to determine whether the benefit from collecting the data would exceed the airlines’ cost to report the data. Officials also noted that the agency has undertaken efforts to provide additional information to consumers. Notably, to provide more insight into the underlying causes of delay attributed to late arriving aircraft, BTS began calculating the original causes of delays in the late arriving aircraft category and providing these data on its website in response to a recommendation made by the DOT Inspector General in 2013.

Information on the Effects on Passengers Is Largely Anecdotal and Illustrates Varied Passenger Experiences

No data are publicly available to quantify with any degree of precision the number of passengers affected by airline IT outages, and only one airline provided this type of information to us. Airline contracts of carriage set the minimum accommodations passengers are entitled to when their flights are delayed or canceled, which could include refunds, rebooking, or other amenities, such as food or meals. However, there is no comprehensive information about the accommodations that were actually received by passengers, and available information is largely anecdotal.

Even with respect to the same IT outage, different people may be affected differently. For example, passengers may be affected by the complexity of the NAS and their individual circumstances. According to an airline representative we spoke with, an airline may be able to quickly rebook affected passengers on a different airline for one destination, for example, but may have difficulty rebooking passengers for another destination if other flights are full. Further, while network airlines have hub-and-spoke networks that include a number of route options or frequent service between cities, others—particularly point-to-point or low- cost carriers—may have more limited service, further constraining the ability to rebook individual passengers. Finally, passengers travel for different reasons and their tolerance for disruption can differ, as well, according to DOT officials. Thus, someone flying to visit a friend may have a different tolerance for delay than someone traveling for a job interview, they noted.

Airlines are required by DOT to provide refunds for canceled—and significantly delayed—flights if a passenger chooses to cancel his or her trip. Beyond these requirements, however, airlines are not obligated to provide accommodations for flight disruptions such as cancellations and delays unless specified in an airline’s contract of carriage, according to DOT. These contracts govern what, if anything, a passenger is entitled to, although airlines may offer additional accommodations to inconvenienced passengers. Generally accommodations received by inconvenienced passengers could include rebooking on the same airline or alternate travel; refunds or compensation in the form of money or other benefits (e.g., credit for later travel); and amenities such as hotel stays and food, according to their contracts of carriage. Airlines can—and in some cases do—go above and beyond the obligations set forth in their contracts of carriage, as illustrated by some examples below.

Accommodations Included in Airlines’ Contracts of Carriage Vary

To better understand the accommodations that passengers may have received as the result of airline IT outages, we reviewed airlines’ contracts of carriage for the airlines in our scope with applicable contracts. None of these contracts addressed IT outages directly, but flight disruptions caused by outages would be covered under the broader contract terms addressing cancellations and delays. We found that the contracts vary in terms of what accommodations are provided for, as well as the extent to which airlines have discretion in providing them. For example, while several airline contracts include provisions to provide hotel vouchers, transportation to the hotel, or meals, other airlines—notably several low- cost carriers—do not. Likewise, some airlines establish set time thresholds for when they are obligated to provide a certain accommodation (e.g., after a delay of at least 4 hours), while others do not. Specific accommodations we identified in our review of airline contracts of carriage are discussed below, and table 1 further details some of the variation that we found.

Alternate transportation. All nine airlines in our analysis provide for rebooking on their own airline in the event of a flight delay or cancellation such as might be caused by an airline IT outage, although Frontier includes certain airports near a passenger’s original destination as acceptable alternatives in its contract of carriage. Under this exception, for example, Frontier could rebook a passenger on a flight to Tampa if he or she had originally planned to travel to Orlando, or vice versa, in the event of a flight disruption. Three of the airline contracts of carriage we reviewed provide for travel on a different airline—or the use of alternate ground transportation— typically at their discretion, and a fourth airline provides for alternate transportation if a passenger’s flight has been diverted to a different airport. Airline representatives with two low-cost carriers described their unsuccessful efforts to develop agreements with network airlines to facilitate the rebooking of passengers on another airline.

Refunds for cancellations. If a flight is canceled and no alternative is available—or if available flights are not acceptable to the passenger— all nine airlines in our analysis provide for refunds, although three airlines may instead reroute passengers to nearby cities. Under their contracts of carriage, airlines typically provide refunds for the unused portion of a ticket in the event of flight disruptions. If, for example, passengers have already completed the outbound portion of a roundtrip ticket, they would receive a partial refund for the unused, return portion, rather than the entire ticket. Finally, three airlines (Hawaiian, Southwest, and United) offer passengers the option of travel credits in lieu of a refund in their contracts of carriage.

Refunds for delays. The majority of airlines in our review provides refunds or flight credit for flight delays, although refunds in some cases could be contingent on the absence of an acceptable alternative, such as being rebooked on a subsequent flight or to an alternate airport. As mentioned above, DOT requires airlines to provide refunds for flights that are “significantly delayed” but does not define how long such a delay is and instead relies on a case-by-case determination. Four of the contracts we reviewed establish a specific timeframe for the delay after which a passenger is entitled to a refund, while the others do not establish such a threshold. For example, a passenger flying on Alaska Airlines could request and receive a refund for a flight disruption lasting at least 2 hours, and passengers on Delta are entitled to a refund, if requested, after a 90 minute delay. By contrast, airlines without a defined threshold for a delayed flight have discretion for when passengers would be eligible for refunds, particularly with regard to nonrefundable tickets.

Hotel stay. The majority of airlines in our review provide for hotel stays in their contracts of carriage (and ground transportation to the hotel), to varying degrees, although two low-cost carriers (Frontier and Southwest) do not. The contracts of carriage for seven airlines include a hotel stay for passengers inconvenienced by flight disruptions, and of these four stipulate that passengers have to be away from home or from their points of origin or destination; five require that the flight disruption span certain hours (e.g., 10pm to 6am); and one includes credit for a long-distance phone call.

Four of the contracts we reviewed include additional provisions for hotel stays (or other accommodations) to passengers with disabilities or other needs. For example, under its contract of carriage, American will provide amenities to maintain the safety and welfare of certain passengers if they are delayed (e.g., customers with disabilities, unaccompanied children, the elderly, or others with special needs or circumstances).

Food. Three airlines in our review provide for meals for passengers inconvenienced by flight disruptions in their contracts of carriage. For example, JetBlue’s contract of carriage provides for meal vouchers or pizza for flight delays of 6 or more hours. In addition, airlines may deliver meals or offer other amenities to passengers waiting for delayed or canceled flights, even in the absence of the promise of food in the contract of carriage. In these cases, additional accommodations may be publicly announced on airline websites, by social media accounts, or through statements to the press, or they may be provided directly to individual flights or passengers at the airport. For example, in response to severe thunderstorms in 2017, Delta had pizza delivered to passengers waiting in airports across the Southeast.

Monetary compensation or travel credit. Inconvenienced passengers are not entitled to monetary compensation in the case of a flight delay or cancellation in the United States, and none of the airlines in our review includes such compensation in their contracts of carriage. Nevertheless, two airline contracts of carriage include provisions for travel credit—above and beyond a refund—for flight disruptions. JetBlue’s contract of carriage provides for travel credit for canceled or delayed flights with several tiers, depending on the timing of the cancellation or length of the delay. For example, passengers delayed over 6 hours are entitled to $250 credit for future travel on JetBlue. Likewise, Alaska’s contract provides for a discount code for future travel (and a letter of apology) for passengers delayed longer than 2 hours. Although not included in Delta’s contract of carriage, the airline provided $200 in travel vouchers to all customers with flight disruptions lasting at least 3 hours for two of the IT outages we identified, according to airline representatives.

Consumer Concerns Stemming from Airline IT Outages

As mentioned above, collecting and analyzing passenger complaints is one way DOT helps ensure that an airline fulfills its obligations included in its contract of carriage and customer service plan, as well as any additional accommodations that may be publicly offered. Our review of passenger complaints filed with DOT stemming from airline IT outages found that they included complaints related to the lack of monetary compensation for delayed or canceled flights and refusals to refund other expenses, such as rental cars or missed hotel or cruise reservations, among other concerns. For example, complaints related to a Southwest outage in 2016 included several related to lack of compensation or other amenities, such as food or hotel stays offered by the airline. As noted above, Southwest’s contract of carriage does not provide for compensation, food, or hotel stays in the event of a delay or cancellation. Complaints filed after the Delta outage of 2016 acknowledged receipt of a $200 travel voucher in compensation or a hotel voucher, but pointed to other non-refunded expenses incurred or difficulties in redeeming these vouchers.

The three consumer or passenger advocacy groups with whom we spoke raised several concerns with regard to passengers inconvenienced by airline IT outages. Stakeholders we spoke with responded to these concerns and addressed how airlines respond to IT outages.

Passengers may not receive the same accommodations. In the absence of requirements for accommodations or compensation, passengers are dependent on whether or not the affected airline chooses to be generous, according to the consumer advocates we interviewed. They also noted that mileage plan or first class passengers may receive more accommodations than others, even when passengers are affected by the same underlying outage, as may be true in other circumstances, as well. Representatives from one airline told us that they attempt to promptly address the needs of all of their passengers but acknowledged that accommodations may vary depending on passenger circumstances, including passenger status (e.g., frequent-flyer program members or VIP travelers).

Airline obligations toward affected passengers may be confusing for passengers. According to consumer advocates we spoke with, even if a passenger understands that an airline’s contract of carriage lays out its obligations to passengers affected by an IT outage, these contracts are often lengthy and difficult to understand. As noted above, our review of DOT complaints stemming from airline IT outages found that many passengers expected to receive compensation or other accommodations in response to these events, although such accommodations were not included in contracts of carriage. We reported in 2017 that airlines committed to reviewing their contracts of carriage to see if they could be simplified.

Contracts of carriage may not clearly exclude IT outages from force majeure events, according to consumer advocates. Flight disruptions caused by extreme weather, terrorism, and other events that are seen as being beyond the control of the airline are typically treated as special situations in airline contracts of carriage, and as a result, inconvenienced passengers may not receive accommodations that they otherwise might. Consumer advocates voiced concerns that airline IT outages might be treated as events outside the airline’s control (i.e., Acts of God or force majeure events) given ambiguity in how these exceptions are defined. We found that IT outages were not explicitly included among the force majeure events identified in the contracts of carriage we reviewed. In interviews and written statements, representatives with four of the airlines in our review varied in the extent to which they characterized airline IT outages as incidents in the control of the airline, but generally indicated that passengers would be accommodated as if the outages were.

Agency Comments

We provided the Department of Transportation (DOT) with a draft of this report for review and comment. DOT responded by email and provided technical clarifications, which we incorporated into the report as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of the Department of Transportation, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-2834 or KrauseH@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

Our objectives for this report were to: identify (1) the Department of Transportation’s (DOT) and Federal Aviation Administration’s (FAA) roles, if any, in relation to airline IT outages and their effects and (2) what is known about these outages, including the number of flights and passengers affected.

The scope of this report focuses on those airline IT systems that affect passenger experiences, including systems related to reservations and check-in, as well as those used by airlines for flight planning and dispatch. Our scope excluded IT systems involved in avionics (such as aircraft navigation systems); in-flight operations (such as passenger WiFi networks); and internal operations (such as company email systems). Our analysis included the 12 airlines that were required to report on-time performance information to DOT’s Bureau of Transportation Statistics (BTS) from 2015 through 2017, including network carriers (Alaska, American, Delta, and United); low-cost carriers (Frontier, JetBlue, Spirit, Southwest, and Virgin America); regional carriers that provide service for partner airlines (ExpressJet and SkyWest); and Hawaiian, which provides a niche service. Given the role of third-party IT providers, we also included Amadeus and Sabre in our scope.

To identify relevant DOT and FAA authorities and responsibilities vis-à-vis airline IT outages in several areas, including operations, oversight, and data-collection, we reviewed relevant laws, regulations, policies, and guidance, as well as prior GAO work addressing agency roles. We interviewed DOT officials with

BTS, which collects data on airline on-time performance, and the Office of the Assistant General Counsel for Aviation Enforcement and Proceedings and its Aviation Consumer Protection Division, which oversee consumer protections and receive consumer complaints.

We also interviewed FAA officials with the Office of the Chief Information Security Officer, which advises the agency on matters relating to IT management and security. Within FAA’s Air Traffic Organization, we interviewed officials with Systems Operations Services, which administers traffic management initiatives including ground stops, and its National Airspace System (NAS) Operations and Office of Performance Analysis. These two offices are responsible for programs related to air traffic control systems and assessing the performance of the NAS, respectively.

Through our review of relevant plans and an interview with officials in DOT’s Office of the Secretary, we determined that airline IT systems are not included in federal plans for critical infrastructure protection. According to DOT officials, outages in these systems do not have the potential to reach established thresholds for potential casualties or damages. By contrast, air traffic control systems and airports are included in sector-specific plans addressing critical infrastructure protection in the case of a terrorist attack or other natural or manmade disaster.

To determine what is known about airline IT outages, we reviewed DOT data sources, including BTS and FAA performance and operations data, as well as passenger complaints received by DOT in response to airline IT outages from 2015 through August 2018. We also conducted interviews with or received written responses from 11 (of 12) airlines in our scope, and interviewed other stakeholders, including third-party IT system providers Amadeus and Sabre; an IT risk expert (Robert Charette); industry associations, including Airlines for American (A4A), the Regional Airline Association (RAA), and Airports Council International (ACI); and employee union representatives with the Air Line Pilots Association (ALPA).

We determined that DOT and FAA data were not designed, and could not be used, to comprehensively identify airline IT outages. To identify airline IT outages in the absence of detailed DOT or FAA data, academic literature, or internal (proprietary) airline data on these incidents, we validated a preliminary list of such outages developed using open source material that included media coverage and publicly available airline sources for outages from 2015 through 2017. Specifically, we searched GAO subscription databases (e.g., ProQuest, Nexis, and EBSCO) to create a preliminary list of 37 airline IT outages from media coverage; performed additional searches of articles and official airline websites to collect more information on and corroborate incidents identified; provided our list of identified IT outages to the 12 airlines in our scope and two third-party IT providers (Amadeus and Sabre) for confirmation; and corroborated 20 of the identified IT outages with FAA’s National Traffic Management Log’s (NTML) log entries and DOT’s consumer complaint data.

Through this process, we were able to corroborate 34 airline IT outages from 2015 through 2017, and we are confident that our list of outages includes all of the outages large enough to garner national-level, multi- day media coverage and an official response from an airline executive. While accurate, our list is not comprehensive because three airlines and a third-party IT provider identified additional outages that we did not find in our preliminary search, including one airline that shared information on more than 20 additional outages. We did not include these additional outages in our count to ensure that our methodology was consistent.

To account for outages that may have occurred subsequent to our review, we identified an online listing of airline IT outages and validated 9 of 11 of the outages included from 2018 through January 2019 using publicly available airline or airport information or coverage in at least 3 media sources. This list and our validation process provides evidence that airline IT outages continued to occur during this timeframe, but does not match the rigor applied to the identification of outages we identified from 2015 through 2017. As a result, we are not confident that this list identified all of the outages large enough to garner national-level, multi- day media coverage and an official response from an airline executive.

Once we had identified airline IT outages through other sources and could look at data for specific dates, we were able to use DOT and FAA data to provide additional insight into flight disruptions (i.e., flight delays or cancellations) and ground stops caused by outages. For example, we requested that FAA conduct analysis on 3 of the 34 outages we had identified to determine what FAA operational data could reveal about the effects of these outages. We selected these 3 outages to reflect a range of flight disruptions for comparative analysis, including variations in size and cause of the outage. We also assessed the extent to which the effects on passengers could be seen in the BTS on-time performance data reported by airlines. For these data, we sought to determine the cause and magnitude of delays and cancellations for each outage. We also reviewed NTML log entries for the dates of known outages to further identify potential information, including incidents of ground stops. Finally, to obtain more information about the potential effects on passengers resulting from these events, we reviewed consumer complaints to DOT stemming from airline IT outages. These complaints were provided to us by DOT’s Aviation Consumer Protection Division and include reference to the associated outage.

To understand how airlines accommodate inconvenienced passengers, we reviewed airline contracts of carriage for 9 of the 12 the airlines in our scope. These contracts are the legally binding contracts between carriers and passengers and may include specific provisions such as refund procedures and responsibility for delayed flights, among other things. We excluded two regional airlines (ExpressJet and SkyWest) that operate under the contracts of carriage of their mainline partners and Virgin America, which merged with Alaska in 2018 and no longer has a separate contract of carriage. In addition to the stakeholders mentioned above, we also interviewed consumer or passenger advocacy groups, including representatives with the Consumers Union, the National Consumers League, and Travelers United to identify any concerns regarding consumers affected by airline IT outages.

We conducted this performance audit from February 2018 to June 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: GAO Contact and Staff Acknowledgments

GAO Contact

Heather Krause, (202) 512-2834 or KrauseH@gao.gov.

Staff Acknowledgments

In addition to the individual named above, other key contributors to this report were Jonathan Carver, Assistant Director; Molly Laster, Analyst-in- Charge; Neha Bhatt; David Hooper; Rich Hung; Delwen Jones; SaraAnn Moessbauer; Emily Mussey; Josh Ormond; Corinne Quinones; Pamela Snedden; James Sweetman, Jr.; and Elizabeth Wood.