Commercial Aviation: Information on Airline IT Outages

In recent years, the airline industry experienced several well-publicized IT system outages to reservation, check-in, flight planning, and other systems. Such outages can result in widespread disruption to air travel, inconveniencing passengers, who may be delayed or face out-of-pocket costs, and can also affect airlines' revenue and operations. Airlines are responsible for operating and maintaining their IT systems.

GAO was asked to review airline IT outages. GAO examined: (1) DOT's and FAA's roles related to airline IT outages and (2) what is known about these outages and their effects on passengers. GAO identified relevant federal laws and responsibilities and interviewed DOT and FAA officials. In the absence of DOT and FAA data to identify airline IT outages, GAO identified outages using open source documents for the 12 airlines reporting to BTS from 2015 through 2017 and validated these outages using a multi-step process with publicly available airline information, interviews with airline representatives, and FAA and DOT data. GAO also reviewed airlines' contracts of carriage, which are legally binding contracts between airlines and passengers, to understand how airlines accommodate passengers inconvenienced by IT outages, as well as 140 consumer complaints related to airline IT outages received by DOT from 2015 through June 2018.

The Department of Transportation (DOT) and, within it, the Federal Aviation Administration (FAA) have limited roles overseeing or addressing the effects of outages from information technology (IT) systems that airlines rely on to schedule and transport passengers (e.g., reservation or flight planning systems).

FAA's operations and oversight. At an airline's request, FAA may halt the operation of all or part of that airline's flights during an outage and work with the airline to reintegrate flights upon recovery. FAA does not directly oversee airline IT systems but works with airlines to ensure that airline data interfaces correctly with FAA's operational systems.

DOT's consumer protection. Airline IT outages are not specifically addressed in DOT's consumer protections for passengers, although other protections may apply, such as restrictions on tarmac delays if a passenger is held on a flight during an outage. DOT oversees airlines' adherence to their contracts with passengers. These may include specific provisions such as refund procedures and responsibility for delayed flights, among other things. DOT also receives consumer complaints and uses complaint data to initiate investigations that may result in fines or enforcement actions.

DOT's data collection. DOT requires large airlines to report information about on-time performance to the Bureau of Transportation Statistics (BTS), including the causes of flight delays and cancellations in several broad categories (e.g., airline caused, weather, and late-arriving aircraft).

Using multiple sources, GAO identified 34 IT outages from 2015 through 2017, affecting 11 of 12 selected airlines. No government data were available to identify IT outages or determine how many flights or passengers were affected by such outages. BTS data provide information to consumers about airline performance broadly but are not designed to identify the effects of individual events, such as the number of flight delays and cancellations resulting from IT outages. According to GAO's validation of multiple sources, however, about 85 percent of the identified outages resulted in some flight delays or cancellations. Because of limited data, information about how passengers have been inconvenienced from outages is largely anecdotal (see figure for examples of inconveniences). Further, airlines vary in what they provide to these passengers (e.g., food, hotel, or rebooking on another airline) when IT outages occur. Consumer complaints stemming from IT outages accounted for less than one percent of all complaints received by DOT from 2015 through June 2018, and according to agency officials, these complaints raised concerns similar to complaints resulting from other causes of flight disruption. Complaints reviewed by GAO included the lack of food, a hotel, or compensation, among other things.

In recent years, several information technology (IT) system outages at  U.S. airlines have drawn public attention to the resulting widespread  disruption to air travel. For example, in June 2018, American Airline’s  subsidiary PSA Airlines experienced an IT issue that led to the  cancellation of about 3,000 flights over the following week and cost  American Airlines an estimated $35 million in pre-tax income, according  to financial filings made by American Airlines. Likewise, in 2016 an  outage in the system that Delta Air Lines uses to check in and board  passengers resulted in the cancellation of 2,300 flights over 3 days and  cost the airline $150 million in lost revenue, according to statements and  financial filings made by the airline.

Airline IT systems can include those that are used for flight and crew  planning, passenger reservations or check-in, or for providing flight  information to the Federal Aviation Administration (FAA), among others.  As with any industry, airlines’ IT investment decisions—including  purchasing, maintaining, and operating these systems—are internal  business decisions. Yet when these systems fail, they can delay or cancel  flights and result in out-of-pocket expenses for passengers, who may  have to pay for alternative travel, food, or lodging, or a combination of the  three.

The Department of Transportation (DOT) has a role in ensuring that  airlines adhere to certain consumer protections for passengers, such as  providing timely refunds for canceled flights. DOT also requires large airlines to report on their on-time performance to the Bureau of  Transportation Statistics (BTS) and shares this information with  consumers and others. Within DOT, FAA is responsible for ensuring the  safe, efficient operation of the National Airspace System (NAS), including  managing air traffic control.

You asked us to review issues related to airline IT outages. This report  addresses: (1) DOT’s and FAA’s roles in relation to such outages and  their effects; and (2) what is known about airline IT outages, including the  number of flights and passengers affected.

The scope of this report is focused on airline IT systems that affect  passenger experiences, including systems related to reservations and  check-in, as well as those used by airlines for flight planning and  dispatch.

To determine relevant DOT and FAA roles, we identified DOT and FAA  authorities and responsibilities vis-à-vis airline IT outages in several  areas, including operations, consumer protection, and critical  infrastructure protection, by reviewing relevant laws, regulations, policies,  and guidance, as well as our prior work. We interviewed DOT officials  with BTS and the Office of the Assistant General Counsel for Aviation  Enforcement and Proceedings, which oversees consumer protections and  receives consumer complaints, as well as officials with FAA’s Office of the  Chief Information Security Officer, which advises the agency on matters  relating to IT management and security. We also interviewed FAA  officials with the Air Traffic Organization and its Systems Operations  Services, which administers traffic management initiatives such as ground  stops.

To determine what is known about airline IT outages, including the  number of flights and passengers affected, we assessed whether DOT  data, including BTS and FAA performance and operations data could be  used to identify such outages and their effects. We determined that these  data were not designed, and could not be used, to comprehensively  identify airline IT outages. However, these data provided some insight  into flight disruptions (i.e., flight delays or cancellations) and ground stops  caused by outages once we had identified outages through other sources  and could look at data for specific dates.

In the absence of DOT or FAA data to identify airline IT outages, we  validated a preliminary list of such outages that we developed using open  source material from 2015 through 2017 for the 12 airlines that were  required to report on-time performance information to BTS during this  time period and two leading third-party IT providers (Amadeus and Sabre)  that provide airlines with the types of IT services included in our scope.  This validation was done using publicly available airline information (e.g.,  on websites and in press releases) and interviews with representatives  from 11 of the 12 airlines, Amadeus, and Sabre. We also further  corroborated some of these outages with FAA operations data and DOT  consumer complaints. Through this process, we are confident that our list  includes all airline IT outages large enough to garner national-level, multi- day media coverage and an official response from an airline executive.  To identify trends, if any, in IT outages, their potential causes, and effects  on passengers, we interviewed representatives of the 11 airlines  mentioned above, as well as other stakeholders, including an IT risk  expert, three industry associations, and representatives from one  employee union.

To understand how airlines accommodate inconvenienced passengers,  we reviewed airline contracts of carriage for the nine airlines in our scope  with applicable contracts. Airlines’ contracts of carriage are the legally  binding contracts between carriers and passengers and may include  specific provisions such as refund procedures and responsibility for  delayed flights, among other things. We reviewed passenger complaints  received by DOT from 2015 through June 2018 stemming from airline IT  outages to provide insight into what adverse effects passengers may  have experienced as a result. We also interviewed the industry  associations noted above and three consumer and passenger advocacy  groups to identify any concerns regarding consumers affected by airline  IT outages. See appendix I for more information on our scope and  methodology.

We conducted this performance audit from February 2018 to June 2019  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

In the U.S. commercial airline industry, passengers travel on network,  low-cost, and regional airlines. With thousands of employees and  hundreds of aircraft, network airlines support large, complex hub-and- spoke operations, which provide service at various fare levels to many  destinations. Low-cost airlines generally operate under a low-cost  business model, which typically includes providing point-to-point service  using fewer types of aircraft. Regional airlines typically operate small  aircraft—turboprops or regional jets with up to 100 seats—and generally  provide service to smaller communities on behalf of network airlines.

Airlines rely on a wide variety of IT systems to schedule and transport  passengers; some of these IT systems interface with networks operated  by travel-booking sites, other airlines, and the FAA. These IT systems  touch all phases of a passenger’s travel experience, including booking,  check-in, boarding, and baggage, as well as airline operations behind the  scene, including flight planning, crew scheduling, and flight dispatch,  according to FAA. In addition, aviation stakeholders explained that airline  IT systems operate in a dynamic, data-intensive environment that  demands around-the-clock availability and real-time information. In recent  years, the introduction of new mobile applications and  telecommunications infrastructure has added to the myriad systems and  network connections now critical to an airline’s operations.

Airlines face challenges in maintaining or enhancing their IT systems. For  example, some airlines operate a web of IT systems that were developed  over many years as manual systems transitioned to electronic and  computer-processed functions. Replacing software and upgrading these  older systems, such as reservations and crew scheduling, can be  complicated undertakings as airlines serve millions of travelers and need  to keep data flowing across their networks. For example, in its financial  filings, Southwest pointed to the significant challenges and costs involved  in introducing new IT capabilities while managing existing systems.  Increasingly dependent on the use of IT systems to run its ongoing  operations, the company recently completed a multi-year initiative to  transition to a new third-party reservation system through Amadeus,  among other investments.

In addition, a wave of industry consolidation stemming from airline  bankruptcies in the late 2000s has affected airline IT systems, requiring  significant sustained focus among airlines on merging different IT  infrastructures necessary to support worldwide flight operations without  interruption. For instance, we previously found that United struggled to integrate computer and reservation systems following its merger with  Continental in 2010, although the airline has subsequently completed this  transition, according to airline representatives. Likewise, in 2015  American pointed to its reliance on technology when discussing principal  risks posed by the integration of its computer, communications, and other  technology systems with those of US Airways following the merger of the  two airlines.

Additionally, some airlines rely on regional partners or third-party IT  providers to help manage certain IT systems, such as reservations, crew  scheduling, and flight dispatch, further adding to the variety of systems  that airlines depend on to run their operations. Moreover, the airline  industry is going through a transformation as it shifts to digital  merchandizing and retailing to better serve consumers, a process which  requires access to real-time information, according to an industry  stakeholder. Finally, the speed of technology evolution has accelerated,  making it a constant and iterative process to keep systems refreshed and  operating in sync, a situation that poses additional challenges, according  to a stakeholder.

Passengers may be affected by an airline IT outage in different ways  depending, in part, on the type and severity of the outage—for example,  whether the outage stems from a software glitch or a hardware failure— and the system affected. (See fig. 1.) Effects can range from standing in line to be checked in by a ticket agent instead of using a mobile  application to delayed and canceled flights if a hardware failure forces the  airline to ground all of its flights until the system is back online. System  failures may have cascading effects across other airline IT systems or  operations, as well. For example, an outage in a flight dispatch system  could cause hours-long delays for subsequent flights. Likewise, aviation  stakeholders noted that crew positioning can hinder recovery from an  outage as delayed flight crews “time out,” further extending the effects of  an outage. In addition to these effects, passengers and airlines can also  face higher costs from delayed or canceled travel, including increased  operational expenses facing airlines as crews and aircraft sit idle, as well  as indirect costs, such as those faced by travelers as their itineraries are  delayed or canceled.

FAA and DOT Have Limited Roles in Overseeing Airline IT Systems and Addressing Effects from Outages on Passengers

FAA’s Role Is Primarily Initiating Traffic Management Initiatives Requested by Airlines

FAA plays a key, but limited, operational role in responding to airline IT  outages. As previously noted, FAA is responsible for ensuring the safe,  efficient operation of the NAS. Agency officials we interviewed  emphasized that airline IT outages have a limited effect on FAA’s  management of the NAS because such outages tend to affect the  demand for airspace, not its capacity. As a result, FAA officials explained  that if flights are delayed or canceled because of an airline IT outage, the  NAS is often less congested for those that remain flying.

However, in managing the air-traffic control system, FAA is responsible  for initiating and administering traffic management initiatives (such as a  ground stop) if requested by an airline experiencing an IT outage. For  example, an airline might request that FAA initiate a ground stop if the  airline is unable to report flight dispatch information to the FAA, such as  the weight and balance of aircraft. FAA works with airlines to  accommodate flights back into the NAS when the outage is over. Once an  airline recovers from an outage, FAA may also need to initiate traffic  management initiatives if demand exceeds capacity in the system— potentially causing delays both for the airline that experienced the outage,  as well as others.

FAA does not routinely collect data about airline IT outages—which fall  outside of its management of the NAS, according to agency officials— although it does collect data on NAS operations, which could include  some information about these events. Specifically:

The National Traffic Management Log (NTML)—the real-time  narrative log of NAS traffic management initiatives kept by air traffic  controllers—includes information about ground stops or other  initiatives such as time the stop was put in place, affected airports,  and when the initiative was lifted. Log entries may also include  additional information about the outage, if such information is provided  to air traffic control by the airline experiencing it.

The Operations Network (OPSNET) system, among others, collects  operational data, including air traffic operations and delay data to  analyze the performance of the FAA’s air traffic control facilities.  However, according to agency officials, data on the effects of airline IT  outages (including delay and cancellation data related to airline IT  outages) are discarded because information about airline-caused  flight disruptions do not provide instructive information to FAA about  whether the agency is efficiently operating the NAS.

FAA does not directly oversee airline IT systems related to reservations,  check-in, baggage, and boarding or their use, according to agency  officials. These systems are managed by the airlines themselves. For  airline IT systems that interface with FAA’s operational systems, such as  automated systems used in air traffic control, FAA works with airlines to  ensure that any output (i.e., data feeds) interfaces correctly with the  agency’s systems. FAA may provide observations to the airline if its IT  systems are not providing accurate information, such as if crews are not  being correctly scheduled and tracked, fuel plans are not accurate, or  flight plans are not correctly calculated and observable.

For Passengers, DOT Helps Ensure Compliance with Consumer Protections, Which May Be Triggered by Certain Airline IT Outages

DOT’s Office of the Assistant General Counsel for Aviation Enforcement  and Proceedings and its Aviation Consumer Protection Division are  responsible for helping ensure airlines’ compliance with passenger  protection requirements and educating passengers on their rights. Airline  IT outages are not specifically addressed by any of DOT’s consumer  protection regulations. Rather, when these outages occur, they may  trigger broader consumer protections afforded passengers. For  example, airlines are required by DOT’s interpretation of the statutory  prohibition on unfair and deceptive practices to provide refunds for flights  that are canceled or significantly delayed if a passenger declines any  rerouting that the airline may offer. In the case of delay, however, what  amounts to a significant delay is not defined in this policy, and as  discussed below, individual airlines may or may not set their own  thresholds. According to agency officials, DOT is currently conducting a  review of air carriers’ handling of involuntary changes to passengers’  travel itineraries. DOT also regulates compliance through its tarmac  delay rule, which requires airlines to mitigate or avoid consumer harm in  the event of a lengthy tarmac delay. In addition to these consumer  protection regulations and policies, DOT oversees airlines’ compliance  with obligations included in airline contracts of carriage or customer  service plans. These contracts and plans must be publicly posted by  airlines on their websites.

As we have previously reported, DOT helps ensure airlines’ compliance  with its passenger protection requirements by educating airlines on new  regulations or clarifying existing regulations, responding to airlines’  questions, and reviewing airlines’ consumer service policies. According  to DOT officials, the agency encourages proactive reporting of incidents  by airlines, such as airline IT outages, including a brief description of the  incident and any steps taken by the airline to provide accommodation to  affected consumers. DOT also receives and investigates complaints from  passengers and uses complaint data to identify which airlines to inspect  and whether to begin investigations that may result in fines or  enforcement actions. According to agency officials, DOT received 126  complaints that explicitly mentioned a domestic airline IT outage from  2015 through 2017. These complaints involved five such outages. For  comparison, in all, the agency received between 17,000 and 21,000  complaints per calendar year during that timeframe, according to DOT’s  Air Travel Consumer Report. According to DOT officials, complaints that  explicitly mentioned an airline IT outage largely mirror in substance those  received for other causes of flight disruptions. (These complaints are  discussed in more detail below.)

According to DOT officials, no investigations have been carried out  focusing solely on airline IT outages, but DOT investigations have  included airline IT outages that contributed to violations of DOT’s  consumer protection regulations. For example, DOT found that an IT  outage affecting Delta’s operational systems, including gate management  and flight dispatch systems, caused significant surface congestion and  resulted in a violation of tarmac delay regulations. This violation was  among those included in enforcement proceedings resulting in a civil  penalty and consent order to the airline.

Finally, to monitor airline on-time performance and baggage handling and  to provide information to consumers, DOT requires certain airlines to  report data to BTS monthly, including the causes of flight delays and  cancellations. However, the causes are grouped into broad categories  and do not specify IT outages as a cause. BTS, which is an independent  statistical agency within DOT, publishes summary data from reporting air  carriers on the number of domestic on-time, delayed, canceled, and  diverted flights on its website. DOT’s Office of Aviation Enforcement and  Proceedings also publishes a monthly Air Travel Consumer Report with  this information. We discuss these data in greater detail below.

Information on Airline IT Outages and Their Effects Is Limited, but Suggests That Outages Result in a Range of Passenger Inconveniences

We Identified 34 IT Outages Affecting Almost Every Domestic Airline in Our Review

Using a variety of information sources, we identified 34 airline IT outages  from 2015 through 2017 affecting 11 of the 12 airlines in our review. No  government data, academic literature, or other information source could  be used to determine a comprehensive count of airline IT outages, and  information is also limited regarding the types, causes, and effects of  these incidents. Additionally, airlines do not regularly share detailed data  about their IT outages publicly, such as the number of flights or  passengers affected or the technical cause of the outage, although  general information about these incidents is sometimes provided on their  websites and social media accounts or to the press.

To identify airline IT outages in the absence of other sources of  information, we validated a preliminary list of outages developed through  a review of open source information, including media coverage. This  preliminary list was validated through a combination of interviews with the  airlines and third-party IT providers and a review of publicly available  airline information, FAA NTML log entries, and DOT consumer  complaints. Through our validation process, airline representatives and  others identified additional airline IT outages that had not been reported  or acknowledged publicly by airlines or third-party IT providers, reflecting  the variation in quantity or quality of information available regarding these  events. For example, we found more information about IT outages that  had nationwide or multi-day consumer or operational effects because  these incidents garnered more coverage—and often an official airline  response—as compared to those that were of shorter duration or affected  a regional carrier or smaller number of flights, passengers, or airports.  Additionally, we found less or incomplete information on outages at third- party IT providers and regional carriers because their effects were  dispersed across multiple airlines.

We found that the number and severity of flight disruptions associated  with the airline IT outages we identified varied widely. About 85 percent  (29 of 34) of our identified outages resulted in some flight disruptions,  including 5 outages we identified that caused over 800 delays or  cancellations. However, we were unable to verify the exact number of  disrupted flights caused by each outage. At least 14 outages resulted in a  ground stop, some of which lasted for several hours, according to a  review of FAA’s NTML logs. We identified seven outages that had no  associated flight disruptions, although they inconvenienced customers in  other ways. For example, during these incidents customers experienced  problems buying tickets online, checking into flights on an airline’s  website, or using frequent flier benefits.

Because no comprehensive data are available on airline IT outages and  their related effects, we could not compare these incidents with the  effects on flights caused by other disruptive events, such as severe  weather like hurricanes or snowstorms. However, FAA analysis of two of  the IT outages that caused over 800 flight disruptions found that the  number of delays or cancellations resulting from these outages was on  par with or worse than those caused by severe weather in the same  months the outages occurred. Likewise, representatives from one airline  stated that operational effects from airline IT outages are comparable to  severe weather events, although outages occur much less frequently. An  aviation industry representative noted that these events are typically  unexpected, hindering the ability of airlines to react and recover. By  contrast, disruptions from weather may be forecast ahead of time,  allowing airlines to prepare for predicted disruptions, including  accommodating customers, adjusting flight crews and schedules, and  pre-positioning aircraft, according to the same representative.

The airline IT outages we identified were caused by a range of IT and  infrastructure issues, according to airline representatives we interviewed  and official press statements. These issues included hardware failures,  software outages or slowdowns, power or telecommunications failures,  and network connectivity issues, among others. In several instances, an  IT issue in one airline system had cascading effects across other systems  not affected by the initial outage. For example, a large volume of online  traffic shut down an airline’s website and subsequently disrupted the  airline’s reservations and check-in systems. Representatives from six  airlines, an IT expert, and four other aviation industry stakeholders  pointed to a variety of factors that could contribute to an outage or  magnify the effect of an IT disruption. These factors ranged from  underinvestment in IT systems after years of poor airline profitability,  increasing requirements on aging systems or systems not designed to  work together, and the introduction of new customer-oriented platforms  and services.

Representatives from airlines we interviewed also described some of their  IT system investments and risk mitigation efforts undertaken in response  to an outage or to address potential disruptions, such as investing in new  backup systems or technologies. For example, five airlines have sought  to reduce vulnerability by expanding IT operations beyond a single data  center or moving them to the cloud, which allows for the delivery of  computing services through the Internet. Likewise, two airlines described  efforts to ensure connectivity and reduce the effects of IT disruptions by  using multiple telecommunications network providers. Several airline  representatives and an IT expert said that these airline IT investments are  aimed at enhancing overall system functionality as well as revenue.  However, the IT risk expert we spoke with noted that carrying out major  upgrades to their IT systems can be challenging because these systems  are always in use. Additionally, according to stakeholders we interviewed,  airlines employ a variety of contingency planning and recovery strategies  to respond to unforeseen technical issues, including IT outages. For  example, one airline described incorporating routine system testing,  artificial intelligence, and outage drills into planning for system disruptions  to avoid outages or speed recovery. Airline efforts to increase the  resiliency of their IT systems, such as those described above, could  prevent or lessen the impact of such outages.

BTS Data Broadly Capture Flight Delays and Cancellations

BTS data capture the causes of flight delays and cancellations in several  broad categories, which do not isolate flight disruptions resulting from  airline IT outages and do not reflect the root cause of flight disruptions. As  previously mentioned, BTS collects on-time performance data from the  airlines, including the causes of flight delays and cancellations. On a  monthly basis, certain airlines are required to report at least one cause of  delay (in minutes) for each flight delayed 15 minutes or more from the  following five categories: air carrier, extreme weather, NAS, security, and  late arriving aircraft. Similarly, for each flight that was canceled, airlines  are required to report the cause from one of four categories: air carrier,  extreme weather, NAS, and security. BTS guidance instructs airlines to  report flight delays that are within the control of the airlines in the air- carrier category. Also included in the air-carrier category, according to the  guidance, are more than 40 other potential causes of delays or  cancellations, such as aircraft maintenance, baggage, terminal  operations, and crew matters. As a result, flight disruptions from IT outages are indistinguishable from other airline-caused issues within this  category.

Additionally, delays caused by airline IT outages may be captured in a  category other than air carrier because of how airlines can report the  causes of flight delays based on BTS guidance. For example:

Multiple causes for a delay. Airlines have the option to report either  just the main cause or all the causes for a flight delay as long as the  airline consistently applies the same method in its monthly report to  BTS. Also, if there is more than one cause for a flight delay that starts  at the same time, airlines are required to report the cause that lasted  the longest. As a result, delays caused by an airline IT outage may be  attributed to other categories if they happen at the same time as other  issues affecting an airline’s operations, such as poor weather or  airport conditions.

Late arriving aircraft delays. Airlines can report a flight delay in the  late arriving aircraft category if the previous flight arrived late and  caused the next flight (on the same aircraft) to depart late. Airlines are  not required to provide additional information on the cause of the  delay for the previous flight (air carrier, NAS, security, or extreme  weather). As a result, delays from incidents that can cause ripple  effects on an airline’s operations, such as an IT outage or severe  thunderstorms, may be attributed to the late arriving aircraft category.

NAS delays. Airlines can report delays in the control of the FAA,  airport operators, or state and local officials in the NAS category,  which includes ground stops, flight volume delays, and air traffic  control issues, among others. However, BTS guidance does not  specify how airlines should report delays caused by ground stops  requested by the airlines, including after an IT outage. As a result,  these delays may be captured in the NAS category.

BTS data are collected to provide general information on the quality of  airline performance to consumers and to improve airline scheduling,  rather than detailed information about specific flights or events.

Consequently, these data provide limited insight into the effects of  individual events, including airline IT outages, both because flight  disruptions may be captured in more than one category and because the  data do not allow for the isolation of effects for affected flights.

We reviewed BTS data for most of the airline IT outages we identified and  found, for example, that for 3 outages, airlines reported the largest total  number of flight delays in the NAS causal category on the day that the  airline requested a ground stop because of the outage—rather than in the  air-carrier category. In addition, we reviewed BTS data for the 5 outages  we identified where the airline involved delayed or canceled at least 800  total flights and found that airlines spread the causes of flight delays and  cancellations across several categories, primarily air carrier, late arriving  aircraft, and NAS for the first day of these outages. For example, we  found that airlines attributed 44 percent of all reported flight delays to late  arriving aircraft for these days. (See fig. 4).

DOT officials did not see a need for additional reporting requirements on  flight delays and cancellations caused by airline IT outages given the  effects of such events are not unique when compared to other causes of  flight delay and because these incidents involve a small portion of  consumer complaints received by DOT. Aviation stakeholders we spoke  to told us that airlines track flight disruptions for internal purposes such as  managing operations and scheduling. For example, representatives from  one airline said that the airline tracks delays and cancellations associated  with IT outages and other issues internally to identify patterns and  reoccurring issues that need improvement, such as scheduling, staffing,  and maintenance. DOT officials noted that obtaining more detailed  information on the causes of flight delays and cancellations would require  a cost and benefit analysis to determine whether the benefit from  collecting the data would exceed the airlines’ cost to report the data.  Officials also noted that the agency has undertaken efforts to provide  additional information to consumers. Notably, to provide more insight  into the underlying causes of delay attributed to late arriving aircraft, BTS  began calculating the original causes of delays in the late arriving aircraft  category and providing these data on its website in response to a  recommendation made by the DOT Inspector General in 2013.

Information on the Effects on Passengers Is Largely Anecdotal and Illustrates Varied Passenger Experiences

No data are publicly available to quantify with any degree of precision the  number of passengers affected by airline IT outages, and only one airline  provided this type of information to us. Airline contracts of carriage set  the minimum accommodations passengers are entitled to when their  flights are delayed or canceled, which could include refunds, rebooking,  or other amenities, such as food or meals. However, there is no  comprehensive information about the accommodations that were actually  received by passengers, and available information is largely anecdotal.

Even with respect to the same IT outage, different people may be  affected differently. For example, passengers may be affected by the  complexity of the NAS and their individual circumstances. According to an  airline representative we spoke with, an airline may be able to quickly  rebook affected passengers on a different airline for one destination, for  example, but may have difficulty rebooking passengers for another  destination if other flights are full. Further, while network airlines have  hub-and-spoke networks that include a number of route options or  frequent service between cities, others—particularly point-to-point or low- cost carriers—may have more limited service, further constraining the  ability to rebook individual passengers. Finally, passengers travel for  different reasons and their tolerance for disruption can differ, as well,  according to DOT officials. Thus, someone flying to visit a friend may  have a different tolerance for delay than someone traveling for a job  interview, they noted.

Airlines are required by DOT to provide refunds for canceled—and  significantly delayed—flights if a passenger chooses to cancel his or her  trip. Beyond these requirements, however, airlines are not obligated to  provide accommodations for flight disruptions such as cancellations and  delays unless specified in an airline’s contract of carriage, according to  DOT. These contracts govern what, if anything, a passenger is entitled  to, although airlines may offer additional accommodations to  inconvenienced passengers. Generally accommodations received by  inconvenienced passengers could include rebooking on the same airline  or alternate travel; refunds or compensation in the form of money or other  benefits (e.g., credit for later travel); and amenities such as hotel stays  and food, according to their contracts of carriage. Airlines can—and in  some cases do—go above and beyond the obligations set forth in their  contracts of carriage, as illustrated by some examples below.

Accommodations Included in Airlines’ Contracts of Carriage Vary

To better understand the accommodations that passengers may have  received as the result of airline IT outages, we reviewed airlines’ contracts  of carriage for the airlines in our scope with applicable contracts. None  of these contracts addressed IT outages directly, but flight disruptions  caused by outages would be covered under the broader contract terms  addressing cancellations and delays. We found that the contracts vary in  terms of what accommodations are provided for, as well as the extent to  which airlines have discretion in providing them. For example, while  several airline contracts include provisions to provide hotel vouchers,  transportation to the hotel, or meals, other airlines—notably several low- cost carriers—do not. Likewise, some airlines establish set time  thresholds for when they are obligated to provide a certain  accommodation (e.g., after a delay of at least 4 hours), while others do  not. Specific accommodations we identified in our review of airline  contracts of carriage are discussed below, and table 1 further details  some of the variation that we found.

Alternate transportation. All nine airlines in our analysis provide for  rebooking on their own airline in the event of a flight delay or  cancellation such as might be caused by an airline IT outage,  although Frontier includes certain airports near a passenger’s original  destination as acceptable alternatives in its contract of carriage.  Under this exception, for example, Frontier could rebook a passenger  on a flight to Tampa if he or she had originally planned to travel to  Orlando, or vice versa, in the event of a flight disruption. Three of the  airline contracts of carriage we reviewed provide for travel on a  different airline—or the use of alternate ground transportation— typically at their discretion, and a fourth airline provides for alternate  transportation if a passenger’s flight has been diverted to a different  airport. Airline representatives with two low-cost carriers described  their unsuccessful efforts to develop agreements with network airlines  to facilitate the rebooking of passengers on another airline.

Refunds for cancellations. If a flight is canceled and no alternative is  available—or if available flights are not acceptable to the passenger— all nine airlines in our analysis provide for refunds, although three  airlines may instead reroute passengers to nearby cities. Under their  contracts of carriage, airlines typically provide refunds for the unused  portion of a ticket in the event of flight disruptions. If, for example,  passengers have already completed the outbound portion of a  roundtrip ticket, they would receive a partial refund for the unused,  return portion, rather than the entire ticket. Finally, three airlines  (Hawaiian, Southwest, and United) offer passengers the option of  travel credits in lieu of a refund in their contracts of carriage.

Refunds for delays. The majority of airlines in our review provides  refunds or flight credit for flight delays, although refunds in some  cases could be contingent on the absence of an acceptable  alternative, such as being rebooked on a subsequent flight or to an  alternate airport. As mentioned above, DOT requires airlines to  provide refunds for flights that are “significantly delayed” but does not  define how long such a delay is and instead relies on a case-by-case  determination. Four of the contracts we reviewed establish a specific  timeframe for the delay after which a passenger is entitled to a refund,  while the others do not establish such a threshold. For example, a  passenger flying on Alaska Airlines could request and receive a  refund for a flight disruption lasting at least 2 hours, and passengers  on Delta are entitled to a refund, if requested, after a 90 minute delay.  By contrast, airlines without a defined threshold for a delayed flight  have discretion for when passengers would be eligible for refunds,  particularly with regard to nonrefundable tickets.

Hotel stay. The majority of airlines in our review provide for hotel  stays in their contracts of carriage (and ground transportation to the  hotel), to varying degrees, although two low-cost carriers (Frontier and  Southwest) do not. The contracts of carriage for seven airlines include  a hotel stay for passengers inconvenienced by flight disruptions, and  of these  four stipulate that passengers have to be away from home or from  their points of origin or destination;  five require that the flight disruption span certain hours (e.g., 10pm  to 6am); and one includes credit for a long-distance phone call.

Four of the contracts we reviewed include additional provisions for  hotel stays (or other accommodations) to passengers with disabilities  or other needs. For example, under its contract of carriage, American  will provide amenities to maintain the safety and welfare of certain  passengers if they are delayed (e.g., customers with disabilities,  unaccompanied children, the elderly, or others with special needs or  circumstances).

Food. Three airlines in our review provide for meals for passengers  inconvenienced by flight disruptions in their contracts of carriage. For  example, JetBlue’s contract of carriage provides for meal vouchers or  pizza for flight delays of 6 or more hours. In addition, airlines may  deliver meals or offer other amenities to passengers waiting for  delayed or canceled flights, even in the absence of the promise of  food in the contract of carriage. In these cases, additional  accommodations may be publicly announced on airline websites, by  social media accounts, or through statements to the press, or they  may be provided directly to individual flights or passengers at the  airport. For example, in response to severe thunderstorms in 2017,  Delta had pizza delivered to passengers waiting in airports across the  Southeast.

Monetary compensation or travel credit. Inconvenienced  passengers are not entitled to monetary compensation in the case of  a flight delay or cancellation in the United States, and none of the  airlines in our review includes such compensation in their contracts of  carriage. Nevertheless, two airline contracts of carriage include  provisions for travel credit—above and beyond a refund—for flight  disruptions. JetBlue’s contract of carriage provides for travel credit for  canceled or delayed flights with several tiers, depending on the timing  of the cancellation or length of the delay. For example, passengers  delayed over 6 hours are entitled to $250 credit for future travel on  JetBlue. Likewise, Alaska’s contract provides for a discount code for  future travel (and a letter of apology) for passengers delayed longer  than 2 hours. Although not included in Delta’s contract of carriage, the  airline provided $200 in travel vouchers to all customers with flight  disruptions lasting at least 3 hours for two of the IT outages we  identified, according to airline representatives.

Consumer Concerns Stemming from Airline IT Outages

As mentioned above, collecting and analyzing passenger complaints is  one way DOT helps ensure that an airline fulfills its obligations included in  its contract of carriage and customer service plan, as well as any  additional accommodations that may be publicly offered. Our review of  passenger complaints filed with DOT stemming from airline IT outages  found that they included complaints related to the lack of monetary  compensation for delayed or canceled flights and refusals to refund other  expenses, such as rental cars or missed hotel or cruise reservations,  among other concerns. For example, complaints related to a Southwest  outage in 2016 included several related to lack of compensation or other  amenities, such as food or hotel stays offered by the airline. As noted  above, Southwest’s contract of carriage does not provide for  compensation, food, or hotel stays in the event of a delay or cancellation.  Complaints filed after the Delta outage of 2016 acknowledged receipt of a  $200 travel voucher in compensation or a hotel voucher, but pointed to  other non-refunded expenses incurred or difficulties in redeeming these  vouchers.

The three consumer or passenger advocacy groups with whom we spoke  raised several concerns with regard to passengers inconvenienced by  airline IT outages. Stakeholders we spoke with responded to these  concerns and addressed how airlines respond to IT outages.

Passengers may not receive the same accommodations. In the  absence of requirements for accommodations or compensation,  passengers are dependent on whether or not the affected airline  chooses to be generous, according to the consumer advocates we  interviewed. They also noted that mileage plan or first class  passengers may receive more accommodations than others, even  when passengers are affected by the same underlying outage, as  may be true in other circumstances, as well. Representatives from  one airline told us that they attempt to promptly address the needs of  all of their passengers but acknowledged that accommodations may  vary depending on passenger circumstances, including passenger  status (e.g., frequent-flyer program members or VIP travelers).

Airline obligations toward affected passengers may be confusing for  passengers. According to consumer advocates we spoke with, even if  a passenger understands that an airline’s contract of carriage lays out  its obligations to passengers affected by an IT outage, these contracts  are often lengthy and difficult to understand. As noted above, our  review of DOT complaints stemming from airline IT outages found that  many passengers expected to receive compensation or other  accommodations in response to these events, although such  accommodations were not included in contracts of carriage. We  reported in 2017 that airlines committed to reviewing their contracts of  carriage to see if they could be simplified.

Contracts of carriage may not clearly exclude IT outages from force  majeure events, according to consumer advocates. Flight disruptions  caused by extreme weather, terrorism, and other events that are seen  as being beyond the control of the airline are typically treated as  special situations in airline contracts of carriage, and as a result,  inconvenienced passengers may not receive accommodations that  they otherwise might. Consumer advocates voiced concerns that  airline IT outages might be treated as events outside the airline’s  control (i.e., Acts of God or force majeure events) given ambiguity in  how these exceptions are defined. We found that IT outages were not  explicitly included among the force majeure events identified in the  contracts of carriage we reviewed. In interviews and written  statements, representatives with four of the airlines in our review  varied in the extent to which they characterized airline IT outages as  incidents in the control of the airline, but generally indicated that  passengers would be accommodated as if the outages were.

We provided the Department of Transportation (DOT) with a draft of this  report for review and comment. DOT responded by email and provided  technical clarifications, which we incorporated into the report as  appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Department of Transportation, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-2834 or KrauseH@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

Our objectives for this report were to: identify (1) the Department of  Transportation’s (DOT) and Federal Aviation Administration’s (FAA) roles,  if any, in relation to airline IT outages and their effects and (2) what is  known about these outages, including the number of flights and  passengers affected.

The scope of this report focuses on those airline IT systems that affect  passenger experiences, including systems related to reservations and  check-in, as well as those used by airlines for flight planning and  dispatch. Our scope excluded IT systems involved in avionics (such as  aircraft navigation systems); in-flight operations (such as passenger WiFi  networks); and internal operations (such as company email systems). Our  analysis included the 12 airlines that were required to report on-time  performance information to DOT’s Bureau of Transportation Statistics  (BTS) from 2015 through 2017, including network carriers (Alaska,  American, Delta, and United); low-cost carriers (Frontier, JetBlue, Spirit,  Southwest, and Virgin America); regional carriers that provide service for  partner airlines (ExpressJet and SkyWest); and Hawaiian, which provides  a niche service. Given the role of third-party IT providers, we also  included Amadeus and Sabre in our scope.

To identify relevant DOT and FAA authorities and responsibilities vis-à-vis  airline IT outages in several areas, including operations, oversight, and  data-collection, we reviewed relevant laws, regulations, policies, and  guidance, as well as prior GAO work addressing agency roles. We  interviewed DOT officials with

BTS, which collects data on airline on-time performance, and  the Office of the Assistant General Counsel for Aviation Enforcement  and Proceedings and its Aviation Consumer Protection Division,  which oversee consumer protections and receive consumer  complaints.

We also interviewed FAA officials with the Office of the Chief Information  Security Officer, which advises the agency on matters relating to IT  management and security. Within FAA’s Air Traffic Organization, we  interviewed officials with Systems Operations Services, which administers  traffic management initiatives including ground stops, and its National  Airspace System (NAS) Operations and Office of Performance Analysis.  These two offices are responsible for programs related to air traffic control  systems and assessing the performance of the NAS, respectively.

Through our review of relevant plans and an interview with officials in  DOT’s Office of the Secretary, we determined that airline IT systems are  not included in federal plans for critical infrastructure protection.  According to DOT officials, outages in these systems do not have the  potential to reach established thresholds for potential casualties or  damages. By contrast, air traffic control systems and airports are  included in sector-specific plans addressing critical infrastructure  protection in the case of a terrorist attack or other natural or manmade  disaster.

To determine what is known about airline IT outages, we reviewed DOT  data sources, including BTS and FAA performance and operations data,  as well as passenger complaints received by DOT in response to airline  IT outages from 2015 through August 2018. We also conducted  interviews with or received written responses from 11 (of 12) airlines in  our scope, and interviewed other stakeholders, including third-party IT  system providers Amadeus and Sabre; an IT risk expert (Robert  Charette); industry associations, including Airlines for American (A4A),  the Regional Airline Association (RAA), and Airports Council International  (ACI); and employee union representatives with the Air Line Pilots  Association (ALPA).

We determined that DOT and FAA data were not designed, and could not  be used, to comprehensively identify airline IT outages. To identify airline  IT outages in the absence of detailed DOT or FAA data, academic  literature, or internal (proprietary) airline data on these incidents, we  validated a preliminary list of such outages developed using open source  material that included media coverage and publicly available airline  sources for outages from 2015 through 2017. Specifically, we  searched GAO subscription databases (e.g., ProQuest, Nexis, and  EBSCO) to create a preliminary list of 37 airline IT outages from  media coverage; performed additional searches of articles and official airline websites  to collect more information on and corroborate incidents identified; provided our list of identified IT outages to the 12 airlines in our scope  and two third-party IT providers (Amadeus and Sabre) for  confirmation; and  corroborated 20 of the identified IT outages with FAA’s National  Traffic Management Log’s (NTML) log entries and DOT’s consumer  complaint data.

Through this process, we were able to corroborate 34 airline IT outages  from 2015 through 2017, and we are confident that our list of outages  includes all of the outages large enough to garner national-level, multi- day media coverage and an official response from an airline executive.  While accurate, our list is not comprehensive because three airlines and a  third-party IT provider identified additional outages that we did not find in  our preliminary search, including one airline that shared information on  more than 20 additional outages. We did not include these additional  outages in our count to ensure that our methodology was consistent.

To account for outages that may have occurred subsequent to our review,  we identified an online listing of airline IT outages and validated 9 of 11 of  the outages included from 2018 through January 2019 using publicly  available airline or airport information or coverage in at least 3 media  sources. This list and our validation process provides evidence that  airline IT outages continued to occur during this timeframe, but does not  match the rigor applied to the identification of outages we identified from  2015 through 2017. As a result, we are not confident that this list  identified all of the outages large enough to garner national-level, multi- day media coverage and an official response from an airline executive.

Once we had identified airline IT outages through other sources and  could look at data for specific dates, we were able to use DOT and FAA  data to provide additional insight into flight disruptions (i.e., flight delays or  cancellations) and ground stops caused by outages. For example, we  requested that FAA conduct analysis on 3 of the 34 outages we had  identified to determine what FAA operational data could reveal about the  effects of these outages. We selected these 3 outages to reflect a range  of flight disruptions for comparative analysis, including variations in size  and cause of the outage. We also assessed the extent to which the  effects on passengers could be seen in the BTS on-time performance  data reported by airlines. For these data, we sought to determine the  cause and magnitude of delays and cancellations for each outage. We  also reviewed NTML log entries for the dates of known outages to further  identify potential information, including incidents of ground stops. Finally,  to obtain more information about the potential effects on passengers  resulting from these events, we reviewed consumer complaints to DOT  stemming from airline IT outages. These complaints were provided to us  by DOT’s Aviation Consumer Protection Division and include reference to  the associated outage.

To understand how airlines accommodate inconvenienced passengers,  we reviewed airline contracts of carriage for 9 of the 12 the airlines in our  scope. These contracts are the legally binding contracts between carriers  and passengers and may include specific provisions such as refund  procedures and responsibility for delayed flights, among other things. We  excluded two regional airlines (ExpressJet and SkyWest) that operate  under the contracts of carriage of their mainline partners and Virgin  America, which merged with Alaska in 2018 and no longer has a separate  contract of carriage. In addition to the stakeholders mentioned above, we  also interviewed consumer or passenger advocacy groups, including  representatives with the Consumers Union, the National Consumers  League, and Travelers United to identify any concerns regarding  consumers affected by airline IT outages.

Appendix II: GAO Contact and Staff Acknowledgments

Heather Krause, (202) 512-2834 or KrauseH@gao.gov.

In addition to the individual named above, other key contributors to this  report were Jonathan Carver, Assistant Director; Molly Laster, Analyst-in- Charge; Neha Bhatt; David Hooper; Rich Hung; Delwen Jones; SaraAnn  Moessbauer; Emily Mussey; Josh Ormond; Corinne Quinones; Pamela  Snedden; James Sweetman, Jr.; and Elizabeth Wood.

Airline information technology systems help keep people moving. An IT outage, however, can lead to delayed flights, long lines, lost baggage, and more. We looked into how often airline IT outages occur, their effects, and what causes them.

Federal agencies collect data to protect consumers and operate the national airspace system—but that data can't be used to identify airline IT outages. Plus, airlines don't regularly share their outage data.

So, we used publicly available sources of information and interviewed airlines to find and confirm 34 airline IT outages in a 3-year span. About 85% of these led to flight delays or cancellations.