Pilots at Delta Air Lines made the horrifying discovery that a company mobile app installed on their personal cellphones could give the airline access to a wealth of personal data.
The discovery came after some flight crew were called by the Chief Pilot and told to delete the popular TikTok social media app from their devices.
As news of the calls started to circulate amongst Delta’s crew, the pilots soon realized that this wasn’t a generic call being made to everyone but only to aircrew who specifically had TikTok installed on their personal cellphones.
Pilots are one of only two workgroups at Delta who are represented by a union, so the Air Line Pilots Association (ALPA) started investigating the claims and filed a grievance with the airline, demanding to know exactly what was happening and whether personal data had been compromised.
It turned out that an app designed for Delta employees to install on their personal devices was able to collect data, such as all the apps that employees have installed on their own phones, as well as the potential ability to track their location.
The app is known as the Delta Hub app, and it allows employees to install internal apps from Delta’s own app store onto their devices.
As a default, when the app is installed, it creates a ‘personal managed’ account that sends information to Delta, including data like the device IP address, which can often be traced to an approximate geographic location.
In an attempt to quell online privacy fears, Delta ended up inviting IT representatives from ALPA to its global headquarters in Georgia to show them exactly what information the Hub app collected.
Perhaps more importantly, however, the airline also shared how to change the app’s settings to stop all this information from being collected – something that had previously not been communicated.
But while Delta might have the apparent technical ability to collect personal data from its employees’ cellphones, in a recent ALPA podcast, First Officer Justin Vandermark, Chair of ALPA’s IT Committee, explained why it was taking so long for the airline to update its backend IT systems.
Thankfully, Delta is slowly moving decades-old mainframe-style computer systems to the cloud, although the process most definitely isn’t over yet.
While much of Delta’s customer-facing IT is state-of-the-art, the airline’s older systems were the cause of major issues in July 2024 when the CrowdStrike outage hit airlines and other businesses around the world.
As other airlines quickly recovered from the frustrating outage, Delta faced days of mass disruption when it lost track of its pilots and flight attendants. Delta is suing CrowdStrike for as much as $500 million over the debacle, although it’s been suggested that the airline would never have faced the chaos it did if it weren’t for the fact that its crew tracking system was so old.
This was only the case because the pilots mistakenly installed the managed profile on their personal device. The unmanaged profile didn’t do anything. The profile (managed or unmanaged ) is required before one could download a few delta approved apps to their personal device. One just had to follow the instructions given by Delta.