Special Conditions: Gulfstream Aerospace Corporation Model GVIII-G700 and GVIII-G800 Series Airplanes; Electronic System Security Protection From Unauthorized External Access, 3335-3337 [2024-00841]
Download as PDF
<![CDATA[
Federal Register / Vol. 89, No. 12 / Thursday, January 18, 2024 / Rules and Regulations
with § 11.38, and they become part of
the type certification basis under
§ 21.101.
khammond on DSKJM1Z7X2PROD with RULES
Novel or Unusual Design Features
The Gulfstream Model GVIII–G700
and GVIII–G800 series airplanes will
incorporate the following novel or
unusual design feature:
The installation of a digital system
that contains a wireless and hardwired
network with hosted application
functionality that allows access, from
sources internal to the airplane, to the
airplane’s internal electronic
components.
Discussion
The Gulfstream Model GVIII–G700
and GVIII–G800 series airplanes
electronic system architecture and
network configuration change are novel
or unusual for commercial transport
airplanes because they are composed of
several connected wireless and
hardwired networks. This proposed
system and network architecture are
used for a diverse set of airplane
functions, including:
• Flight-safety related control and
navigation systems,
• Airline business and administrative
support, and
• Passenger entertainment.
The airplanes’ control domains and
airline information services domain of
these networks perform functions
required for the safe operation and
maintenance of the airplane. Previously,
these domains had very limited
connectivity with other network
sources. This network architecture
creates a potential for unauthorized
persons to access the airplanes’ control
domain from sources internal to the
airplane and presents security
vulnerabilities related to the
introduction of computer viruses and
worms, user errors, and intentional
sabotage of airplane electronic assets
(networks, systems, and databases)
critical to the safety and maintenance of
the airplane.
The existing FAA regulations did not
anticipate these networked airplanesystem architectures. Furthermore, these
regulations and the current guidance
material do not address potential
security vulnerabilities, which could be
exploited by unauthorized access to
airplane networks, data buses, and
servers. Therefore, these special
conditions ensure that the security (i.e.,
confidentiality, integrity, and
availability) of airplane systems will not
be compromised by unauthorized
wireless or hardwired electronic
connections from within the airplane.
These special conditions also require
VerDate Sep<11>2014
16:09 Jan 17, 2024
Jkt 262001
the applicant to provide appropriate
instruction to the operator to maintain
all electronic-system safeguards that
have been implemented as part of the
original network design so that this
feature does not allow or reintroduce
security threats.
These special conditions contain the
additional safety standards that the
Administrator considers necessary to
establish a level of safety equivalent to
that established by the existing
airworthiness standards.
Applicability
As discussed above, these special
conditions are applicable to the
Gulfstream Model GVIII–G700 and
GVIII–G800 series airplanes. Should
Gulfstream apply at a later date for a
change to the type certificate to include
another model that incorporates the
same novel or unusual design feature, or
should any other model already
included on the same type certificate be
modified to incorporate the same novel
or unusual design feature, these special
conditions would apply to the other
model as well.
Conclusion
This action affects only a certain
novel or unusual design feature on one
model on Gulfstream Model GVIII–G700
and GVIII–G800 series of airplanes. It is
not a rule of general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting
and recordkeeping requirements.
Authority Citation
The authority citation for these
special conditions is as follows:
Authority: 49 U.S.C. 106(f), 106(g), 40113,
44701, 44702, and 44704.
The Special Conditions
Accordingly, pursuant to the
authority delegated to me by the
Administrator, the following special
conditions are issued as part of the type
certification basis for Gulfstream Model
GVIII–G700 and GVIII–G800 series
airplanes for airplane electronic-system
internal access:
1. The applicant must ensure that the
design provides isolation from, or
airplane electronic-system security
protection against, access by
unauthorized sources internal to the
airplane. The design must prevent
inadvertent and malicious changes to,
and all adverse impacts upon, airplane
equipment, systems, networks, or other
assets required for safe flight and
operations.
2. The applicant must establish
appropriate procedures to allow the
PO 00000
Frm 00037
Fmt 4700
Sfmt 4700
3335
operator to ensure that continued
airworthiness of the airplane is
maintained, including all post-type
certification modifications that may
have an impact on the approved
electronic-system security safeguards.
Issued in Kansas City, Missouri, on January
11, 2024.
Patrick R. Mullen,
Manager, Technical Innovation Policy
Branch, Policy and Innovation Division,
Aircraft Certification Service.
[FR Doc. 2024–00842 Filed 1–17–24; 8:45 am]
BILLING CODE 4910–13–P
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. FAA–2023–2440; Special
Conditions No. 25–847–SC]
Special Conditions: Gulfstream
Aerospace Corporation Model GVIII–
G700 and GVIII–G800 Series Airplanes;
Electronic System Security Protection
From Unauthorized External Access
Federal Aviation
Administration (FAA), Department of
Transportation (DOT).
ACTION: Final special conditions; request
for comments.
AGENCY:
These special conditions are
issued for the Gulfstream Aerospace
Corporation (Gulfstream) Model GVIII–
G700 and GVIII–G800 series airplanes.
These airplanes will have a novel or
unusual design feature when compared
to the state of technology envisioned in
the airworthiness standards for
transport-category airplanes. This
design feature is associated with the
installation of a digital systems
architecture that will allow increased
connectivity to and access from external
network sources, (e.g., operator
networks, wireless devices, internet
connectivity, service provider satellite
communications, electronic flight bags,
etc.) to the airplane’s previously isolated
electronic assets (networks, systems,
and databases). The applicable
airworthiness regulations do not contain
adequate or appropriate safety standards
for this design feature. These special
conditions contain the additional safety
standards that the Administrator
considers necessary to establish a level
of safety equivalent to that established
by the existing airworthiness standards.
DATES: This action is effective on
Gulfstream on January 18, 2024. Send
comments on or before March 4, 2024.
SUMMARY:
E:\FR\FM\18JAR1.SGM
18JAR1
3336
Federal Register / Vol. 89, No. 12 / Thursday, January 18, 2024 / Rules and Regulations
Send comments identified
by Docket No. FAA–2023–2440 using
any of the following methods:
• Federal eRegulations Portal: Go to
www.regulations.gov and follow the
online instructions for sending your
comments electronically.
• Mail: Send comments to Docket
Operations, M–30, U.S. Department of
Transportation (DOT), 1200 New Jersey
Avenue SE, Room W12–140, West
Building Ground Floor, Washington,
DC, 20590–0001.
• Hand Delivery or Courier: Take
comments to Docket Operations in
Room W12–140 of the West Building
Ground Floor at 1200 New Jersey
Avenue SE, Washington, DC, between 9
a.m. and 5 p.m., Monday through
Friday, except Federal holidays.
• Fax: Fax comments to Docket
Operations at 202–493–2251.
• Docket: Background documents or
comments received may be read at
www.regulations.gov at any time.
Follow the online instructions for
accessing the docket or go to Docket
Operations in Room W12–140 of the
West Building Ground Floor at 1200
New Jersey Avenue SE, Washington,
DC, between 9 a.m. and 5 p.m., Monday
through Friday, except Federal holidays.
ADDRESSES:
FOR FURTHER INFORMATION CONTACT:
Thuan T. Nguyen, Avionics Software
and Components Unit, AIR–626D,
Technical Policy Branch, Aircraft
Certification Service, Federal Aviation
Administration, 2200 South 216th
Street, Des Moines, Washington 98198;
telephone and fax (206) 231–3365; email
Thuan.T.Nguyen@faa.gov.
The
substance of these special conditions
has been published in the Federal
Register for public comment in several
prior instances with no substantive
comments received. Therefore, the FAA
finds, pursuant to 14 CFR 11.38(b), that
new comments are unlikely, and notice
and comment prior to this publication
are unnecessary.
SUPPLEMENTARY INFORMATION:
khammond on DSKJM1Z7X2PROD with RULES
Privacy
Except for Confidential Business
Information (CBI) as described in the
following paragraph, and other
information as described in title 14,
Code of Federal Regulations (14 CFR),
§ 11.35, the FAA will post all comments
received without change to
www.regulations.gov, including any
personal information you provide. The
FAA will also post a report
summarizing each substantive verbal
contact received about these special
conditions.
VerDate Sep<11>2014
16:09 Jan 17, 2024
Jkt 262001
Confidential Business Information
Confidential Business Information
(CBI) is commercial or financial
information that is both customarily and
actually treated as private by its owner.
Under the Freedom of Information Act
(FOIA) (5 U.S.C. 552), CBI is exempt
from public disclosure. If your
comments responsive to these special
conditions contain commercial or
financial information that is customarily
treated as private, that you actually treat
as private, and that is relevant or
responsive to these special conditions, it
is important that you clearly designate
the submitted comments as CBI. Please
mark each page of your submission
containing CBI as ‘‘PROPIN.’’ The FAA
will treat such marked submissions as
confidential under the FOIA, and the
indicated comments will not be placed
in the public docket of these special
conditions. Send submissions
containing CBI to the individual listed
in the FOR FURTHER INFORMATION
CONTACT section above. Comments the
FAA receives, which are not specifically
designated as CBI, will be placed in the
public docket for these special
conditions.
Comments Invited
The FAA invites interested people to
take part in this rulemaking by sending
written comments, data, or views. The
most helpful comments reference a
specific portion of the special
conditions, explain the reason for any
recommended change, and include
supporting data.
The FAA will consider all comments
received by the closing date for
comments, and will consider comments
filed late if it is possible to do so
without incurring delay. The FAA may
change these special conditions based
on the comments received.
Background
On December 31, 2019, Gulfstream
applied for an amendment to Type
Certificate No. T00015AT to include the
new Model GVIII–G700 and GVIII–G800
series airplanes. The Model GVIII–G700
and GVIII–G800 series airplanes, which
are derivatives of the Model GVI
currently approved under Type
Certificate No. T00015AT, are twinengine, transport-category airplanes,
with a maximum seating for 19
passengers, and a maximum take-off
weight of 107,600 pounds (GVIII–G700)
and 105,600 pounds (GVIII–G800).
Type Certification Basis
Under the provisions of title 14, Code
of Federal Regulations (14 CFR),
§ 21.101, Gulfstream must show that the
Model GVIII–G700 and GVIII–G800
PO 00000
Frm 00038
Fmt 4700
Sfmt 4700
series airplanes meet the applicable
provisions of the regulations listed in
Type Certificate No. T00015AT, or the
applicable regulations in effect on the
date of application for the change,
except for earlier amendments as agreed
upon by the FAA.
If the Administrator finds that the
applicable airworthiness regulations
(e.g., 14 CFR part 25) do not contain
adequate or appropriate safety standards
for the Gulfstream Model GVIII–G700
and GVIII–G800 series airplanes because
of a novel or unusual design feature,
special conditions are prescribed under
the provisions of § 21.16.
Special conditions are initially
applicable to the model for which they
are issued. Should the type certificate
for that model be amended later to
include any other model that
incorporates the same novel or unusual
design feature, or should any other
model already included on the same
type certificate be modified to
incorporate the same novel or unusual
design feature, these special conditions
would also apply to the other model
under § 21.101.
In addition to the applicable
airworthiness regulations and special
conditions, the Gulfstream Model
GVIII–G700 and GVIII–G800 series
airplanes must comply with the
exhaust-emission requirements of 14
CFR part 34, and the noise-certification
requirements of 14 CFR part 36.
The FAA issues special conditions, as
defined in 14 CFR 11.19, in accordance
with § 11.38, and they become part of
the type certification basis under
§ 21.101.
Novel or Unusual Design Features
The Gulfstream Model GVIII–G700
and GVIII–G800 series airplanes will
incorporate the following novel or
unusual design feature:
The installation of a digital systems
architecture that will allow increased
connectivity to and access from external
network sources, (e.g., operator
networks, wireless devices, internet
connectivity, service provider satellite
communications, electronic flight bags,
etc.) to the airplane’s previously isolated
electronic assets (networks, systems,
and databases).
Discussion
The Gulfstream Model GVIII–G700
and GVIII–G800 series airplanes’
electronic system architecture and
network configuration are novel or
unusual for commercial transport
airplanes because it may allow
increased connectivity to and access
from external network sources, airline
operations, and maintenance networks,
E:\FR\FM\18JAR1.SGM
18JAR1
Federal Register / Vol. 89, No. 12 / Thursday, January 18, 2024 / Rules and Regulations
to the airplane control domain, and
airline information services domain.
The airplanes’ control domain and
airline information-services domain
perform functions required for the safe
operation and maintenance of the
airplane. Previously, these domains had
very limited connectivity with external
network sources. This data network and
design integration creates a potential for
unauthorized persons to access the
airplanes’ control domain and airline
information-services domain and
presents security vulnerabilities related
to the introduction of computer viruses
and worms, user errors, and intentional
sabotage of airplane electronic assets
(networks, systems, and databases)
critical to the safety and maintenance of
the airplane.
The existing FAA regulations did not
anticipate these networked airplanesystem architectures. Furthermore, these
regulations and the current guidance
material do not address potential
security vulnerabilities, which could be
exploited by unauthorized access to
airplane networks, data buses, and
servers. Therefore, these special
conditions ensure that the security (i.e.,
confidentiality, integrity, and
availability) of the airplane’s systems is
not compromised by unauthorized
wired or wireless electronic
connections. This includes ensuring
that the security of the airplane’s
systems is not compromised during
maintenance of the airplane’s electronic
systems. These special conditions also
require the applicant to provide
appropriate instructions to the operator
to maintain all electronic-system
safeguards that have been implemented
as part of the original network design so
that this feature does not allow or
introduce security threats.
These special conditions contain the
additional safety standards that the
Administrator considers necessary to
establish a level of safety equivalent to
that established by the existing
airworthiness standards.
khammond on DSKJM1Z7X2PROD with RULES
Applicability
As discussed above, these special
conditions are applicable to the
Gulfstream Model GVIII–G700 and
GVIII–G800 series airplanes. Should
Gulfstream apply at a later date for a
change to the type certificate to include
another model that incorporates the
same novel or unusual design feature, or
should any other model already
included on the same type certificate be
modified to incorporate the same novel
or unusual design feature, these special
conditions would apply to that model as
well.
VerDate Sep<11>2014
16:09 Jan 17, 2024
Jkt 262001
3337
Conclusion
DEPARTMENT OF TRANSPORTATION
This action affects only a certain
novel or unusual design feature on the
Gulfstream Model GVIII–G700 and
GVIII–G800 series of airplanes. It is not
a rule of general applicability.
Federal Aviation Administration
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting
and recordkeeping requirements.
Authority Citation
The authority citation for these
special conditions is as follows:
Authority: 49 U.S.C. 106(f), 106(g), 40113,
44701, 44702, and 44704.
The Special Conditions
Accordingly, pursuant to the
authority delegated to me by the
Administrator, the following special
conditions are issued as part of the type
certification basis for Gulfstream Model
GVIII–G700 and GVIII–G800 series
airplanes for airplane electronic
unauthorized external access.
1. The applicant must ensure that the
airplane electronic systems are
protected from access by unauthorized
sources external to the airplane,
including those possibly caused by
maintenance activity.
2. The applicant must ensure that
airplane electronic system-security
threats are identified and assessed, and
that effective electronic system-security
protection strategies are implemented to
protect the airplane from all adverse
impacts on safety, functionality, and
continued airworthiness.
3. The applicant must establish
appropriate procedures to allow the
operator to ensure that continued
airworthiness of the airplane is
maintained, including all post-typecertification modifications that may
have an impact on the approved
electronic system-security safeguards.
Issued in Kansas City, Missouri, on January
11, 2024.
Patrick R. Mullen,
Manager, Technical Innovation Policy
Branch, Policy and Innovation Division,
Aircraft Certification Service.
[FR Doc. 2024–00841 Filed 1–17–24; 8:45 am]
BILLING CODE 4910–13–P
PO 00000
Frm 00039
Fmt 4700
Sfmt 4700
14 CFR Part 39
[Docket No. FAA–2024–0032; Project
Identifier AD–2024–00021–T; Amendment
39–22663; AD 2024–02–51]
RIN 2120–AA64
Airworthiness Directives; The Boeing
Company Airplanes
Federal Aviation
Administration (FAA), DOT.
ACTION: Final rule; request for
comments.
AGENCY:
The FAA is adopting a new
airworthiness directive (AD) for certain
The Boeing Company Model 737–9
airplanes. This AD was prompted by a
report of an in-flight departure of a mid
cabin door plug, which resulted in a
rapid decompression of the airplane.
This AD prohibits further flight of
affected airplanes, until the airplane is
inspected and all applicable corrective
actions have been performed. The FAA
previously sent an emergency AD to all
known U.S. owners and operators of
these airplanes. The FAA is issuing this
AD to address the unsafe condition on
these products.
DATES: This AD is effective on January
18, 2024. Emergency AD 2024–02–51,
issued on January 6, 2024, which
contained the requirements of this
amendment, was effective with actual
notice.
The FAA must receive comments on
this AD by March 4, 2024.
ADDRESSES: You may send comments,
using the procedures found in 14 CFR
11.43 and 11.45, by any of the following
methods:
• Federal eRulemaking Portal: Go to
regulations.gov. Follow the instructions
for submitting comments.
• Fax: 202–493–2251.
• Mail: U.S. Department of
Transportation, Docket Operations, M–
30, West Building Ground Floor, Room
W12–140, 1200 New Jersey Avenue SE,
Washington, DC 20590.
• Hand Delivery: Deliver to Mail
address above between 9 a.m. and 5
p.m., Monday through Friday, except
Federal holidays.
AD Docket: You may examine the AD
docket at regulations.gov by searching
for and locating Docket No. FAA–2024–
0032; or in person at Docket Operations
between 9 a.m. and 5 p.m., Monday
through Friday, except Federal holidays.
The AD docket contains this final rule,
any comments received, and other
information. The street address for
Docket Operations is listed above.
SUMMARY:
E:\FR\FM\18JAR1.SGM
18JAR1
]]>Agencies
[Federal Register Volume 89, Number 12 (Thursday, January 18, 2024)]
[Rules and Regulations]
[Pages 3335-3337]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-00841]
-----------------------------------------------------------------------
DEPARTMENT OF TRANSPORTATION
Federal Aviation Administration
14 CFR Part 25
[Docket No. FAA-2023-2440; Special Conditions No. 25-847-SC]
Special Conditions: Gulfstream Aerospace Corporation Model GVIII-
G700 and GVIII-G800 Series Airplanes; Electronic System Security
Protection From Unauthorized External Access
AGENCY: Federal Aviation Administration (FAA), Department of
Transportation (DOT).
ACTION: Final special conditions; request for comments.
-----------------------------------------------------------------------
SUMMARY: These special conditions are issued for the Gulfstream
Aerospace Corporation (Gulfstream) Model GVIII-G700 and GVIII-G800
series airplanes. These airplanes will have a novel or unusual design
feature when compared to the state of technology envisioned in the
airworthiness standards for transport-category airplanes. This design
feature is associated with the installation of a digital systems
architecture that will allow increased connectivity to and access from
external network sources, (e.g., operator networks, wireless devices,
internet connectivity, service provider satellite communications,
electronic flight bags, etc.) to the airplane's previously isolated
electronic assets (networks, systems, and databases). The applicable
airworthiness regulations do not contain adequate or appropriate safety
standards for this design feature. These special conditions contain the
additional safety standards that the Administrator considers necessary
to establish a level of safety equivalent to that established by the
existing airworthiness standards.
DATES: This action is effective on Gulfstream on January 18, 2024. Send
comments on or before March 4, 2024.
[[Page 3336]]
ADDRESSES: Send comments identified by Docket No. FAA-2023-2440 using
any of the following methods:
Federal eRegulations Portal: Go to www.regulations.gov and
follow the online instructions for sending your comments
electronically.
Mail: Send comments to Docket Operations, M-30, U.S.
Department of Transportation (DOT), 1200 New Jersey Avenue SE, Room
W12-140, West Building Ground Floor, Washington, DC, 20590-0001.
Hand Delivery or Courier: Take comments to Docket
Operations in Room W12-140 of the West Building Ground Floor at 1200
New Jersey Avenue SE, Washington, DC, between 9 a.m. and 5 p.m., Monday
through Friday, except Federal holidays.
Fax: Fax comments to Docket Operations at 202-493-2251.
Docket: Background documents or comments received may be
read at www.regulations.gov at any time. Follow the online instructions
for accessing the docket or go to Docket Operations in Room W12-140 of
the West Building Ground Floor at 1200 New Jersey Avenue SE,
Washington, DC, between 9 a.m. and 5 p.m., Monday through Friday,
except Federal holidays.
FOR FURTHER INFORMATION CONTACT: Thuan T. Nguyen, Avionics Software and
Components Unit, AIR-626D, Technical Policy Branch, Aircraft
Certification Service, Federal Aviation Administration, 2200 South
216th Street, Des Moines, Washington 98198; telephone and fax (206)
231-3365; email [email protected].
SUPPLEMENTARY INFORMATION: The substance of these special conditions
has been published in the Federal Register for public comment in
several prior instances with no substantive comments received.
Therefore, the FAA finds, pursuant to 14 CFR 11.38(b), that new
comments are unlikely, and notice and comment prior to this publication
are unnecessary.
Privacy
Except for Confidential Business Information (CBI) as described in
the following paragraph, and other information as described in title
14, Code of Federal Regulations (14 CFR), Sec. 11.35, the FAA will
post all comments received without change to www.regulations.gov,
including any personal information you provide. The FAA will also post
a report summarizing each substantive verbal contact received about
these special conditions.
Confidential Business Information
Confidential Business Information (CBI) is commercial or financial
information that is both customarily and actually treated as private by
its owner. Under the Freedom of Information Act (FOIA) (5 U.S.C. 552),
CBI is exempt from public disclosure. If your comments responsive to
these special conditions contain commercial or financial information
that is customarily treated as private, that you actually treat as
private, and that is relevant or responsive to these special
conditions, it is important that you clearly designate the submitted
comments as CBI. Please mark each page of your submission containing
CBI as ``PROPIN.'' The FAA will treat such marked submissions as
confidential under the FOIA, and the indicated comments will not be
placed in the public docket of these special conditions. Send
submissions containing CBI to the individual listed in the FOR FURTHER
INFORMATION CONTACT section above. Comments the FAA receives, which are
not specifically designated as CBI, will be placed in the public docket
for these special conditions.
Comments Invited
The FAA invites interested people to take part in this rulemaking
by sending written comments, data, or views. The most helpful comments
reference a specific portion of the special conditions, explain the
reason for any recommended change, and include supporting data.
The FAA will consider all comments received by the closing date for
comments, and will consider comments filed late if it is possible to do
so without incurring delay. The FAA may change these special conditions
based on the comments received.
Background
On December 31, 2019, Gulfstream applied for an amendment to Type
Certificate No. T00015AT to include the new Model GVIII-G700 and GVIII-
G800 series airplanes. The Model GVIII-G700 and GVIII-G800 series
airplanes, which are derivatives of the Model GVI currently approved
under Type Certificate No. T00015AT, are twin-engine, transport-
category airplanes, with a maximum seating for 19 passengers, and a
maximum take-off weight of 107,600 pounds (GVIII-G700) and 105,600
pounds (GVIII-G800).
Type Certification Basis
Under the provisions of title 14, Code of Federal Regulations (14
CFR), Sec. 21.101, Gulfstream must show that the Model GVIII-G700 and
GVIII-G800 series airplanes meet the applicable provisions of the
regulations listed in Type Certificate No. T00015AT, or the applicable
regulations in effect on the date of application for the change, except
for earlier amendments as agreed upon by the FAA.
If the Administrator finds that the applicable airworthiness
regulations (e.g., 14 CFR part 25) do not contain adequate or
appropriate safety standards for the Gulfstream Model GVIII-G700 and
GVIII-G800 series airplanes because of a novel or unusual design
feature, special conditions are prescribed under the provisions of
Sec. 21.16.
Special conditions are initially applicable to the model for which
they are issued. Should the type certificate for that model be amended
later to include any other model that incorporates the same novel or
unusual design feature, or should any other model already included on
the same type certificate be modified to incorporate the same novel or
unusual design feature, these special conditions would also apply to
the other model under Sec. 21.101.
In addition to the applicable airworthiness regulations and special
conditions, the Gulfstream Model GVIII-G700 and GVIII-G800 series
airplanes must comply with the exhaust-emission requirements of 14 CFR
part 34, and the noise-certification requirements of 14 CFR part 36.
The FAA issues special conditions, as defined in 14 CFR 11.19, in
accordance with Sec. 11.38, and they become part of the type
certification basis under Sec. 21.101.
Novel or Unusual Design Features
The Gulfstream Model GVIII-G700 and GVIII-G800 series airplanes
will incorporate the following novel or unusual design feature:
The installation of a digital systems architecture that will allow
increased connectivity to and access from external network sources,
(e.g., operator networks, wireless devices, internet connectivity,
service provider satellite communications, electronic flight bags,
etc.) to the airplane's previously isolated electronic assets
(networks, systems, and databases).
Discussion
The Gulfstream Model GVIII-G700 and GVIII-G800 series airplanes'
electronic system architecture and network configuration are novel or
unusual for commercial transport airplanes because it may allow
increased connectivity to and access from external network sources,
airline operations, and maintenance networks,
[[Page 3337]]
to the airplane control domain, and airline information services
domain. The airplanes' control domain and airline information-services
domain perform functions required for the safe operation and
maintenance of the airplane. Previously, these domains had very limited
connectivity with external network sources. This data network and
design integration creates a potential for unauthorized persons to
access the airplanes' control domain and airline information-services
domain and presents security vulnerabilities related to the
introduction of computer viruses and worms, user errors, and
intentional sabotage of airplane electronic assets (networks, systems,
and databases) critical to the safety and maintenance of the airplane.
The existing FAA regulations did not anticipate these networked
airplane-system architectures. Furthermore, these regulations and the
current guidance material do not address potential security
vulnerabilities, which could be exploited by unauthorized access to
airplane networks, data buses, and servers. Therefore, these special
conditions ensure that the security (i.e., confidentiality, integrity,
and availability) of the airplane's systems is not compromised by
unauthorized wired or wireless electronic connections. This includes
ensuring that the security of the airplane's systems is not compromised
during maintenance of the airplane's electronic systems. These special
conditions also require the applicant to provide appropriate
instructions to the operator to maintain all electronic-system
safeguards that have been implemented as part of the original network
design so that this feature does not allow or introduce security
threats.
These special conditions contain the additional safety standards
that the Administrator considers necessary to establish a level of
safety equivalent to that established by the existing airworthiness
standards.
Applicability
As discussed above, these special conditions are applicable to the
Gulfstream Model GVIII-G700 and GVIII-G800 series airplanes. Should
Gulfstream apply at a later date for a change to the type certificate
to include another model that incorporates the same novel or unusual
design feature, or should any other model already included on the same
type certificate be modified to incorporate the same novel or unusual
design feature, these special conditions would apply to that model as
well.
Conclusion
This action affects only a certain novel or unusual design feature
on the Gulfstream Model GVIII-G700 and GVIII-G800 series of airplanes.
It is not a rule of general applicability.
List of Subjects in 14 CFR Part 25
Aircraft, Aviation safety, Reporting and recordkeeping
requirements.
Authority Citation
The authority citation for these special conditions is as follows:
Authority: 49 U.S.C. 106(f), 106(g), 40113, 44701, 44702, and
44704.
The Special Conditions
Accordingly, pursuant to the authority delegated to me by the
Administrator, the following special conditions are issued as part of
the type certification basis for Gulfstream Model GVIII-G700 and GVIII-
G800 series airplanes for airplane electronic unauthorized external
access.
1. The applicant must ensure that the airplane electronic systems
are protected from access by unauthorized sources external to the
airplane, including those possibly caused by maintenance activity.
2. The applicant must ensure that airplane electronic system-
security threats are identified and assessed, and that effective
electronic system-security protection strategies are implemented to
protect the airplane from all adverse impacts on safety, functionality,
and continued airworthiness.
3. The applicant must establish appropriate procedures to allow the
operator to ensure that continued airworthiness of the airplane is
maintained, including all post-type-certification modifications that
may have an impact on the approved electronic system-security
safeguards.
Issued in Kansas City, Missouri, on January 11, 2024.
Patrick R. Mullen,
Manager, Technical Innovation Policy Branch, Policy and Innovation
Division, Aircraft Certification Service.
[FR Doc. 2024-00841 Filed 1-17-24; 8:45 am]
BILLING CODE 4910-13-P
