International and National Civil Aviation Security Legal Framework
The layered legal architecture
AVSEC law is layered. At the top sits ICAO Annex 17 (Security - Safeguarding International Civil Aviation Against Acts of Unlawful Interference), which states Standards (binding, with the word "shall") and Recommended Practices (desirable, "should"). Annex 17 does not prescribe operational detail; that is the job of ICAO Doc 8973 (Security Manual for Safeguarding Civil Aviation Against Acts of Unlawful Interference), which offers guidance. Below that sit national regulations issued by the civil aviation authority, and below those the aerodrome operator's own security programme. Other instruments matter: the Chicago Convention (Articles 1 and 5 on sovereignty and non-scheduled flight), the Tokyo, Hague and Montreal Conventions on offences and jurisdiction, and Resolution 2307-style assembly resolutions. Annex 17 itself rests on the principle that each State sets its own measures for its territory.
Traps candidates fall into
- Confusing Standards with Recommended Practices: only Standards create an obligation to notify differences to ICAO.
- Treating Doc 8973 as binding; it is guidance, though States often adopt it.
- Forgetting the notification of differences duty when a State cannot comply with a Standard.
- Mixing Annex 17 (security) with Annex 19 (safety management) or Annex 9 (facilitation).
- Missing that the State retains ultimate responsibility even when it delegates to an operator.
Rule of thumb
When a question asks "who is responsible?" the answer is the State, unless it asks who implements a measure - then it is the operator, under State oversight. Worked example: a State permits a lower screening standard at a small domestic aerodrome. This is lawful only if it is consistent with its national programme and, if it differs from a Standard, notified to ICAO.