Display Technology

Every departure board runs on a computer. Is anyone guarding It?

Airport screens are operational systems and an airport’s principal voice to passengers. Reassuringly, most protection depends on discipline rather than budget.

Generated by AI/Adobe Stock

October 27, 2026 by Kumar Abhinav — VP, Veratas

Summarize withChatGPTGrokPerplexityClaude

It is 6:40 a.m., and the morning departure wave is at its peak. Security queues snake back toward check-in, and the coffee counters are three deep. Then every departure board flips to the same six words: ALL FLIGHTS CANCELLED. LEAVE THE TERMINAL IMMEDIATELY.

Nobody in the operations center sent it. That hardly matters. People trust what screens tell them, and within seconds thousands are on the move.

I wish this were pure fiction. In 2016, hackers seized the public flight information display systems at two of Vietnam's largest airports to broadcast political messages. Two years later, a cyber attack led Bristol Airport to take its passenger-facing flight information displays offline for two days; staff resorted to whiteboards.

Compute capability comes with every screen

A large airport can run thousands of screens: flight and baggage boards, gate and check-in displays, lounge screens and advertising walls. Every one of them relies on compute capability. Legacy installations, including many FIDS and baggage information systems, use an external media player, typically a PC behind the screen. Many modern displays are SoC-based (system-on-chip), with compute built into the display. Large estates often run both.

Either way, each screen depends on an operating system, a network connection and a password, whether or not anyone remembers what it is.

Screens make tempting targets for three reasons. They run unattended for years. Everyone sees them, so a hijack commands an instant audience. And ownership is divided among the operator, airlines, concessionaires, advertisers and integrators, so no single party owns the risk.

Two factors that shape the risk

External players and SoC displays. External media players are full computers, often running ageing operating systems that are hard to patch, where nobody checks. SoC displays remove that extra box but concentrate trust in the manufacturer's firmware, which must be kept current and locked down. While the two coexist, each needs its own security baseline, with the oldest players replaced first.

Where screens are managed. Cloud management suits retail and advertising. Hybrid estates, cloud-managed with an on-site server for resilience, suit wayfinding and lounges but leave the most doors to lock. On-premise systems keep everything inside the airport, with flight data fed from the Airport Operational Database (AODB). Full control brings full responsibility; this is the natural home for FIDS and BIDS.
The choice matters. A gate screen calling the wrong flight sends two hundred passengers to the wrong aircraft and delays a departure. That is why I decide screen group by screen group.

Isolating the screens that matter

"Just keep it off the network" sounds sensible. In practice, isolation fails in mundane ways: a contractor plugs a USB stick into a media player, nobody switches off a display's Wi-Fi, or a vendor's 4G support modem lies forgotten in a cabinet.

I use four isolation tiers, set per screen group and reviewed twice a year.

1. Tier 0, connected: hardened, cloud-managed retail and advertising screens.
2. Tier 1, segmented: lounges and wayfinding on a separate network, outbound traffic blocked by default.
3. Tier 2, unidirectional: a hardware data diode lets flight data in but nothing out. The minimum for FIDS, BIDS and gate displays.
4. Tier 3, full air gap: no network path; content is loaded through a controlled kiosk. Reserved for security control-room displays.

Where AI fits in

AI is making airport screens more useful: forecasting security queues, pushing gate changes, translating messages and nudging crowds away from bottlenecks.

It also creates new ways to put the wrong message on screen. Instructions hidden in a news ticker can hijack an AI. A convincing fake security alert costs almost nothing. Queue-counting cameras gather personal data protected by India's Digital Personal Data Protection Act, 2023. And auto-publishing can reach hundreds of screens before anyone checks a word.

Four rules make AI signage much safer:

1. A person approves every AI-generated message before it reaches a public or safety screen.
2. Camera images are processed on the device and discarded, so only anonymous counts leave it.
3. Every AI feature has a named owner.
4. AI never writes flight status, security instructions or evacuation guidance.

Where signage is weakest and how to fix it

In my experience, most hijacks exploit basic gaps:

1. No one knows how many screens there are. Build a single inventory, including airline and advertiser screens.
2. Factory PINs and passwords. Change every one on displays, media players and the content management system.
3. Live USB ports, open menus and convenience features. Lock displays and media players into kiosk mode and disable those features.
4. Ageing media players and old firmware. Patch what you can, and retire or isolate anything that no longer receives updates.
5. Signage on a shared network. Give signage a network of its own, separate from airline and tenant systems.
6. CMS consoles open to the internet. Close them. In 2025, attackers were reported exploiting a vulnerability in a widely used signage CMS server (CVE-2024-7399).
7. One login can publish anything. Require multi-factor authentication and a second approver for flight and safety messages.
8. Unchecked content. Play only digitally signed files, so anything tampered with is rejected.
9. No plan for the bad day. Build a safe mode that switches any screen group to a holding message within 60 seconds, and practise it quarterly.

The bottom line

Airport screens are operational systems and an airport's principal voice to passengers. Reassuringly, most protection depends on discipline rather than budget.

Every departure board runs on a computer. It is time someone guarded it.

About Kumar Abhinav

---