Lessons from BA’s IT meltdown

British Airways’ well-publicised IT meltdown recently left approximately 75,000 passengers stranded over the May Bank Holiday weekend. The problems suffered by the carrier highlight the need, in our technology-dependent age, for a reliable IT infrastructure. As a result, BA is now bracing itself for a flurry of compensation claims. IT law expert Carolyn Bertin and disputes lawyer James O’Flinn look at the lessons to be learned from the airline’s systems failure.

The importance of infrastructure

Following news of the issue, BA claimed that the data centre failure was due to a power surge but declined to comment on whether their two Heathrow-based data centres relied on the same Uninterruptible Power Supplies. This highlights, in particular, the essential need for businesses to hold data centres in more than one geographically distinct location and to have backups for each. Data centre and cloud analysts commented in the wake of the BA incident that capacitors used to mitigate surges in power can be a weak link in recovery systems because you don’t know until it fails what the effect will be. This emphasises the importance of having a robust business continuity plan which is regularly tested to identify and quickly address weaknesses so that if there is a real live event, the chances of complete failure are reduced. Regular penetration testing is also a must to identify and address vulnerabilities before a cyber hacker finds and exploits them.

Crisis management

More recently, BA has admitted that human error caused the power outage when someone disconnected the power supply. Whatever the cause, the backup failed and that demonstrates a potential lack of process to ensure that the power was restored without causing the further failures. Having a well-documented and communicated crisis management plan in place can mitigate the effects of an incident (whatever its cause). Had the unwitting employee who pulled the plug been trained in what to do to safely restore power? Had they been informed of who to call in order to help fix the problem without fear of reprisal? All employees and contractors should be made aware of the crisis management plan, and there should be a crisis management team that is on call. The crisis management plan should also be tested periodically. Lessons learned from a mock-up crisis can be the key to avoiding expensive mistakes in a real crisis.

Is it really force majeure?

More and more cloud services providers, co-location centre providers and utility services’ providers are being called on by customers to contractually commit to have in place proven, reliable business continuity plans with stated recovery time objectives. Force majeure clauses in contracts with these service providers do need careful scrutiny as often they seek to call out an occurrence as an extraordinary event when it should not be if reliable backup and failover is in place. Having the right contractual cover and correct procedures in place could save a lot of damage and costs in the long run.

Compensation claims

EU Regulation 261/2004 is the Flight Compensation Regulation which establishes common rules on compensation and assistance to passengers in the event of being denied boarding or experiencing flight cancellations or long delays. This Regulation is intended to enhance and enforce passengers’ rights, to compensate them for the loss of their time and the inconvenience caused, as opposed to reimbursing them for the cost of their ticket. Provided a passenger was travelling on a paid-for (by themselves or a third party) ticket, they are entitled to compensation in the right circumstances.

A passenger can claim if they are departing an EU country or when they are landing in an EU country onboard an EU airline, which British Airways is. If they are travelling between two non-EU countries, then they would be unable to claim under EU Regulation 261/2004.

How much can you claim?

The amount of compensation a passenger can claim is non-negotiable and runs on a sliding scale from €250 to €600 per passenger. These amounts are fixed regardless of the original price of the ticket.

Whether you can claim flight compensation, and the amount you can claim, depends on a number of factors including the destination of departure/arrival, the length of delay and the distance flown. Air passengers in England and Wales have up to six years from the date of their flight to file a flight compensation claim.

The following table sets out the level of flight compensation claimable:

Airlines are required to pay out flight compensation for eligible flights unless they can establish that any delay/cancellation was caused by what is known as extraordinary circumstances. This terminology is relevant to situations where the cause of the delay or cancellation is out of the ordinary. Examples of extraordinary circumstances include sabotage, adverse weather conditions, terrorist action and industrial disputes.

In these scenarios, an airline will not be obligated to pay compensation for any delays suffered if it can establish that it took all reasonable measures.

Compensation for cancelled or delayed flights should be paid in cash, electronic bank transfer, bank order or cheque unless the passenger agrees in writing to accept travel vouchers and/or other services in place of financial compensation.

While the legislation on compensation is clear, it is often the case that airlines seek to drag the process out or claim that extraordinary circumstances apply, meaning a claimant should always be prepared for some degree of dispute.

We may never know the full facts of what happened at BA, but one thing is certain: a significant failure occurred, affecting both of its data centres and, as a result, they were unable to recover the systems and data within an expected normal recovery period. This appears to have resulted in reputation damage and a loss of confidence in the airline, to say nothing of the cost of the claims from passengers for the delays. While BA might have initially sought to rely on an out-of-the-ordinary event to disclaim liability for the delays and avoid having to pay out millions in compensation to affected passengers, the reality is that the “extraordinary event” was not the power failure itself but the fact that it caused a system failure which had the knock-on effect of complete loss of data for a sustained period. It is also something which potentially could have been avoided by having robust and regularly tested backup and failover systems, in addition to a well-communicated crisis management plan in place.