You are on page 1of 2

Federal Register / Vol. 67, No.

216 / Thursday, November 7, 2002 / Notices 67889

by definition a lighter-than-air aircraft. SUMMARY: This notice announces the value may be realized by part 91
The owner or operator of a hot air availability of Advisory Circular No. 00– operators utilizing QICP vendors, if they
balloon is primarily responsible for 62, Internet Communications of so choose. To further clarify that an
maintaining the balloon in an airworthy Aviation Weather and NOTAMs, and approved QICP does not include FAA
condition. The persons performing disposes of comments received on an approval of data source or quality, the
maintenance are responsible for the earlier proposed draft. FAA has added as part of the approval
manner of performance and the FOR FURTHER INFORMATION CONTACT: process, the provider’s agreement to
approval for return to service after work Steven R. Albersheim, Aerospace display a label on its internet site with
is completed. Weather Policy Division, Federal the following recommended language.
DATES: Comments must be received on Aviation Administration, 800 Failure to display this label may result
or before January 6, 2003. Independence Avenue, SW., in losing QICP status.
ADDRESSES: Send all comments on the Washington, DC 20591, (202) 385–7704, This Qualified Internet
proposed AC to: DOT/FAA, or Communication Provider’s (QICP)
Standardization Branch, AFS–640, Attn: servers and communication interfaces
George Torres, 6500 S. MacArthur are approved by the FAA as secure,
Boulevard, ARB Room 304A, Oklahoma Background reliable, and accessible in accordance
City, Oklahoma 73125, or electronically with AC 00–62.
On January 14, 2002 the FAA issued (1) This QICP does not ensure the
to a draft Advisory Circular (AC) on quality and currency of the information
FOR FURTHER INFORMATION CONTACT: Internet Communications of Aviation transmitted to you.
George Torres, AFS–640, at the address Weather and NOTAMs. The FAA (2) You assume the entire risk related
above, by telephone: (405) 954–6923, by requested comment on all aspects of the to the information and its use.
fax: (405) 954–4104, or by e-mail: proposed AC. This AC sets forth the Several commenters questioned the process to become a Qualified Internet nature of the Quality of Service (QOS)
SUPPLEMENTARY INFORMATION: Communications Provider (QICP) and agreements. Each approved QICP’s
addresses issues that relate to accessing maintenance plan has a QOS agreement
Comments Invited aviation weather and NOTAM with each user that addresses how the
The proposed AC is available on the information from approved QICPs. provider will meet measures of
FAA Web site at http:// accessibility, reliability, and security.
Disposition of Comments The QOS agreement should at most,
RegulatorylandlGuidancelLibrary/ Comments were submitted from only reference the standards and
rgDAC.nsf/MainFrame?OpenFrameSet, industry, special interest groups, and provide for complaint procedures if they
under AC No. 43–HAB. A copy of the private individuals. The comments are not maintained, allowing the parties
proposed AC may be obtained by covered various issues, but were to freely negotiate appropriate remedies
contacting the person named above principally concerned with how a and limitations of liability in the event
under FOR FURTHER INFORMATION vendor would meet the provisions of the standards cannot be met for some
CONTACT. Interested persons are invited reliability, accessibility, and security to period of time.
to comment on the proposed AC by be approved as a QICP by the FAA. The Comments were received on the use
submitting such written data, views, or following addresses the issues raised by of standard security technology to
arguments, as they may desire. Please the commenters: ensure site authentication/data integrity.
identify AC 43–HAB, Hot Air Balloon Several commenters questioned and/ Specifically, a commenter disagreed
Inspection and Repair: Acceptable or did not support that the AC does not with the use of Secure Sockets Layer
Methods, Techniques, and Practices, address the quality of a QICP’s service (SSL) because SLL is not a formal
and submit comments, either hard copy or the quality of the QICP’s data. As standard and there are known bugs in
or electronically, to the appropriate stated in the draft AC and reiterated early versions of SSL that allow an
address listed above. Comments may be here, the FAA does not intend to attacker to defeat any authentication
inspected at the above address between provide quality control of QICP data or and integrity assurances that it might
9 a.m. and 4 p.m. weekdays, except approve the data accessed from a QICP. provide, with a similar effort to altering
Federal holidays. While the FAA requires air carriers data from an unsecured HTTP session.
Issued in Washington, DC, on November 1, certificated under 14 CFR parts 121 and The FAA agrees with this comment
2002. 135 to use an FAA-approved source for and has changed the AC to reflect that
Louis C. Cusimano, weather information, the FAA does not approved QICP’s should maintain a
Deputy Director, Flight Standards Service. approve the information supplied to security system that is applicable to
[FR Doc. 02–28372 Filed 11–6–02; 8:45 am]
these carriers, or to pilots conducting current state-of-the-art technology. This
operations under part 91. This AC does also allows the applicant greater
not change the agency’s current position flexibility in implementing a system
on approving quality of data, or sources that complies with the AC while serving
DEPARTMENT OF TRANSPORTATION for other than part 121 and 135 carriers. its customers and minimizing costs. In
A fundamental change such as addition, it is noted that this change
Federal Aviation Administration approving data and/or sources for part assists in preventing unauthorized
91 operations would require rulemaking access to or modification of provider
Advisory Circular No. 00–62, Internet with a public process for notice and data, software and hardware.
Communications of Aviation Weather comment. While these comments are One commenter states that this AC
and NOTAMs noted, the purpose and goal of this AC inadequately describes the disaster
AGENCY: Federal Aviation are not to add these requirements. The recovery and contingency measures.
Administration, DOT. FAA finds value in ensuring that the The FAA does not believe it is necessary
provider’s facility, as an approved to provide specific details on every
ACTION: Notice of availability and
source for part 121 and 135 operators, possible incident that could occur and
disposition of comments.
is reliable, accessible and secure. This believes that the AC provides guidance

VerDate 0ct<31>2002 16:18 Nov 06, 2002 Jkt 200001 PO 00000 Frm 00071 Fmt 4703 Sfmt 4703 E:\FR\FM\07NON1.SGM 07NON1
67890 Federal Register / Vol. 67, No. 216 / Thursday, November 7, 2002 / Notices

to applicants in devising individual The FAA does not discourage those (2) The QICP used must be obtained
security plans. The applicants need to vendors who choose to provide a value- from the approved list provided by the
demonstrate in their application that added service with password restriction FAA.
their security plans will maintain the to their customers. In accordance with (3) For more detailed information
integrity of the data. It is up to each this AC, QICPs are to meet the with regard to QICPs, refer to the
applicant to show how they will minimum-security protocol, which is to
appropriate AC pertaining to Internet
maintain their operation 24 hours per verify the authenticity of the source of
day, seven days a week during any Communications of Aviation Weather
event that could disrupt service. and NOTAMs and Volume 3, Chapter 7,
Comments were received on the need Section 5, of this Order.’’
One commenter states that the FAA’s to further address the provisions of
response to an Application or a Letter of reliability and accessibility, in that the In response to this Notice, the Air
Denial following a Capability measures are too stringent. FAA Transport Association commented that
Demonstration should clearly define the disagrees with this position. In order to it supports the proposal and one air
standards/requirements to be met to meet the purpose of this AC, a QICP’s carrier requested clarification as to
allow the applicant to have its server and communication interface when a Part 121 operator could use an
Application accepted and move on to should have very little down time. In Internet provider for aviation weather
the Capability Demonstration, or to have developing this measure of service, the services.
its Capability Demonstration completed FAA consulted with industry and the
successfully and qualify as a QICP. The Internet AC addresses measures
National Weather Service and believes to be taken by a QICP to assure the
In the event that a vendor’s
this is achievable and easily maintained security, availability, and accessibility
application is unsuccessful initially, the
and consistent with current industry of Internet communications link for
FAA will recommend revisions and
practices. FAA did not receive any providing weather and NOTAM
inform the applicant of any needed
comments on the burden of meeting the
changes. Similarly, a Letter of Denial information. Some of the service
criteria in the AC in response to the
will indicate the reasons for the denial providers that become QICP will likely
solicitation for comments addressing
so that the vendor could make provide a very comprehensive service
reports requirements under the Paper
appropriate changes to successfully while others will provide a narrower
Work Reduction Act of 1995.
complete its Capability Demonstration. service focus. FAA will approve QICP
A commenter suggested that the A commenter recommends that the
status to both types of providers who
approval period last for one or two years FAA consider the feasibility of requiring
meet the communications capabilities in
with a mandatory performance review a certificate of authority for providers of
aviation information, or that other the interest of enabling providers of
of any extension and conduct interim weather and NOTAM service to use the
review upon request. means be identified to provide
authentication and integrity protection. public Internet.
The FAA finds that a six-month
review is appropriate. QICPs are to It is recognized that no form of Availability of the Advisory Circular
provide facility performance statistics Internet security is totally risk free. The
semiannually or upon request. This agency’s intent with this AC is to reduce Aviation weather information is
review assists in ensuring that QICPs are the risk to an acceptable level. The use available on the public Internet from a
meeting the criteria of this AC. of server digital certificates is consistent variety of government and vendor
One commenter argued that the with current business practices, which sources with minimal quality control.
required time for a QICP to respond to the FAA finds to be an acceptable level. Users of the National Airspace System,
a user’s Quality of Service complaints However, a QICP and user have the dispatchers, pilots and air traffic
should be reduced from 14 calendar option of agreeing upon the use of a controllers/specialists have expressed
days to one business day following specific server certificate of their choice interest in the ability to utilize the
receipt. if they believe greater security linkage is public Internet to retrieve aviation
The FAA maintains the 14-calendar warranted. weather text and graphic products for
day response period because while On September 17, 2002 the FAA operational decision-making. The FAA
some complaints may be resolved in a published a proposed Revision to issued Advisory Circular 00–62
very short time frame, other complaints Operations Specifications (OpSpecs) ‘‘Internet Communications of Aviation
may be more difficult to address. Each A010, Aeronautical Weather Data in the Weather and NOTAMS’’ on November
QICP has the option of implementing a Federal Register, which proposed a new 1, 2002 and is available on the FAA
more stringent response period in its requirement for 14 CFR part 121 and
QOS agreement. However, the agency Web page at,
part 135 certificate holders that obtain ars/qicp.
finds that at a minimum, some latitude approved weather data via the public
is necessary and that 14 calendar days Internet for use in flight operations. Issued in Washington, DC, on November 1,
provides that latitude. Under this proposal, these carriers must
One comment questioned the James H. Washington,
use a QICP for Internet communications
necessity for QICPs to authenticate users Director, Air Traffic System Requirements
of aviation weather and NOTAMs.
and limit access to authorized users, in Service.
OpSpec A010, would be amended to
order to provide users with information
read as follows: [FR Doc. 02–28371 Filed 11–6–02; 8:45 am]
that is publicly available to anyone via
other sources. This commenter contends ‘‘For Internet communications of BILLING CODE 4910–13–P

that user authentication can increase the aviation weather and NOTAMS used in
costs of providing such services. flight operations, all part 121 and 135
User authentication is only a operators are required to use an
recommended practice. The significant approved Qualified Internet
aspect is that digital authentication is Communications Provider (QICP):
used so that the user knows that he/she (1) The QICPs used by the operator
has signed on to an approved QICP site. must be listed in OpSpec A010.

VerDate 0ct<31>2002 16:18 Nov 06, 2002 Jkt 200001 PO 00000 Frm 00072 Fmt 4703 Sfmt 4703 E:\FR\FM\07NON1.SGM 07NON1