V-DIG Audit: British Airways

Audit Phase: V-DIG Domain Audit Target Entity: British Airways (wholly owned subsidiary of International Airlines Group, S.A.) Audit Date: May 2026

Enterprise Technology Stack & Vendor Relationships

Amadeus — Core Passenger Services Platform

British Airways’ single most significant confirmed technology dependency is Amadeus IT Group S.A. (headquartered in Madrid, Spain). BA extended its long-term agreement with Amadeus in 2022 ¹ and in 2023 publicly announced Amadeus as its strategic partner for a transformation towards the Nevio offer-and-order retailing platform ². BA is a confirmed launch partner for the Nevio suite. The Altea Passenger Service System underpins BA’s check-in, reservations, and departure control operations, making Amadeus a foundational — not peripheral — enterprise dependency. Amadeus is headquartered in Madrid and is not an Israeli-origin company.

Unverified Israeli-Origin Cybersecurity Vendor Claims

Several Israeli-origin cybersecurity vendors have been associated with British Airways in prior reporting. After cross-referencing vendor press releases, the BA Media Centre, IAG Annual Reports for 2022 and 2023 ³, and credible trade press, none of the following relationships can be confirmed from publicly available sources:

• Source Defense (Rosh Ha’ayin, Israel): Source Defense uses the British Airways 2018 data breach as a primary marketing case study ⁴, citing the ICO’s finding that BA lacked client-side security protections as the exact vulnerability its product addresses. This is vendor-promotional content; the post does not state BA is or was a customer. The ICO penalty notice ⁵ and BA Media Centre contain no reference to a Source Defense engagement. No verified BA–Source Defense contract identified.

• CyberArk (Petah Tikva, Israel) and SentinelOne (Tel Aviv-founded, HQ Mountain View, CA): CyberArk and SentinelOne announced a deepened strategic integration in February 2025 ⁶. Both are widely deployed in large-enterprise aviation environments. However, no public procurement record, contract announcement, or credible trade press article confirms that British Airways holds an active licensing or subscription relationship with either vendor. The inference that BA is a “mutual customer” derives from industry norms, not verified evidence. No public evidence of a direct BA relationship confirmed.

• Check Point Software Technologies (Tel Aviv, Israel): Check Point is widely deployed across aviation and critical infrastructure sectors globally. No BA-specific contract, procurement notice, or announcement has been located. No public evidence of a direct BA relationship confirmed.

• Wiz (Tel Aviv, Israel): Prior reporting characterised a Wiz engagement as a “high probability of integration” given BA’s cloud migration trajectory. The prior report itself acknowledged no contract evidence exists — this is an explicit inference, not a finding. No public evidence of a direct BA relationship confirmed.

Procurement & Integrator Relationships

Amadeus functions as BA’s key passenger services integrator, encompassing the Altea PSS, departure control, and now the Nevio retailing and biometrics stack ²⁷. No evidence has been identified that Amadeus has mandated or deployed Israeli-origin technology as part of its BA engagement (beyond Amadeus’s acquisition of Vision-Box, a Portuguese-headquartered company, discussed in the following section). No other integrator relationship mandating Israeli-origin technology has been identified. No public evidence identified for any further integrator dependency on Israeli-origin vendors.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometric Boarding Deployment

British Airways has been an active adopter of passenger biometric identity management across multiple airports and is among the earliest large European carriers to deploy facial recognition at scale.

• In 2018, BA announced that 250,000 customers had used biometric technology on international flights, specifically at US departure airports (LAX, JFK, MCO) under the US Customs and Border Protection Biometric Exit programme ⁸. These self-boarding gates match passenger faces against the CBP Traveler Verification Service database in real time.
• In 2022, BA launched a trial at Heathrow Terminal 5 enabling passport-free domestic departures using biometric identification — passengers could board without presenting their passport at the departure airport ⁹.
• Amadeus and BA jointly announced a partnership to deploy a fully biometric boarding workflow at Heathrow Terminal 5, described as redefining the passenger experience ⁷¹⁰. This makes Amadeus the prime integrator for BA’s biometric stack at its primary hub.

Vision-Box (Portuguese) as Biometric Hardware Layer

Amadeus acquired Vision-Box (headquartered in Lisbon, Portugal) in 2023 for approximately €320 million ¹¹. Vision-Box manufactures the e-gate hardware and biometric kiosk infrastructure deployed in BA-adjacent biometric environments and has separately installed facial recognition technology at major international airports including JFK [^40]. The acquisition means BA’s biometric hardware supplier is now a wholly owned subsidiary of its primary passenger services integrator. Vision-Box is a Portuguese company, not Israeli-origin.

SITA Biometric Layer

SITA (Geneva-headquartered) provides “Smart Path” biometric identity management and has an expanded partnership with Amadeus that touches BA’s biometric infrastructure at Heathrow ¹⁰. SITA is not Israeli-origin.

Oosto / AnyVision — Algorithmic Supply-Chain Claim: Not Verified

Prior reporting asserted that Vision-Box integrates AnyVision/Oosto (Israeli-origin) facial recognition algorithms, creating a supply-chain link to Israeli military surveillance. This specific claim has not been confirmed in any publicly available Vision-Box, Amadeus, BA, or independent trade press source. Market research groups Vision-Box and AnyVision/Oosto as competitors in the same market segment ¹², not as confirmed technology partners. AnyVision/Oosto rebranded as Oosto in 2021 and pivoted away from government facial recognition contracts following scrutiny over its West Bank surveillance operations and Microsoft’s divestment of its stake ¹³. The controversy is documented for Oosto itself, but no direct or indirect BA–Oosto relationship has been identified. No public evidence identified.

Predictive Analytics, Workforce Monitoring & Third-Party Surveillance Tools

No public evidence of British Airways using Israeli-origin predictive policing, sentiment analysis, social media monitoring, or workforce surveillance tools has been identified. No evidence has been identified that Israeli-origin biometric or surveillance technologies reach BA indirectly through managed security services or bundled enterprise suites. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data Centre Operations in Israel

No public evidence that British Airways operates, leases, or co-locates data centre infrastructure within Israel. No public evidence identified.

Government Cloud Contracts & Project Nimbus

No public evidence that British Airways participates in Project Nimbus or any comparable Israeli state-backed digital infrastructure programme. British Airways is an airline and passenger services operator, not a cloud infrastructure provider. Prior reporting conflated BA’s potential use of cloud security vendors (specifically the unverified Wiz inference) with participation in Project Nimbus; these are categorically separate activities. The Project Nimbus inference as applied to BA does not withstand scrutiny. No public evidence identified.

Data Sovereignty & Resilience Services

No public evidence that BA provides services marketed or contracted for Israeli state institutions or military bodies for digital sovereignty or infrastructure resilience purposes. No public evidence identified.

Defence, Intelligence & Security Sector Technology Relationships

Military & Intelligence Contracts

No verified contract or partnership between British Airways and the Israeli Ministry of Defence, the Israel Defense Forces (IDF), or Israeli intelligence agencies has been identified in any public source. No public evidence identified.

ICTS International / ICTS UK & Ireland — Security Services

ICTS International and its UK operating subsidiary ICTS UK & Ireland provide passenger and baggage security screening, travel document verification, and passenger profiling interview services at airports including Heathrow and Gatwick ¹⁴. ICTS Europe was founded by individuals with Israeli aviation security backgrounds, including former El Al and Israeli security service personnel, and pioneered the behaviour-based passenger questioning methodology associated with Israeli airport security doctrine [formerly documented in ICANN/GAO-era materials]. ICTS UK & Ireland is a separate entity registered in the United Kingdom and operates under UK regulatory frameworks.

Whether ICTS currently holds a specific British Airways contract at Heathrow or Gatwick is not confirmed by a publicly available BA procurement announcement or press release. The ICTS UK & Ireland newsletter (June 2024) ¹⁴ describes ICTS operations generally but does not itemise a BA-specific contract. ICTS’s documented presence at Heathrow makes a working relationship commercially plausible, but the claim cannot be independently verified from public sources. Relationship: plausible but unconfirmed. Treat as unverified pending a verifiable procurement record.

Ground Handling at Ben Gurion Airport — QAS Israel / Knafaim Holdings

British Airways operates scheduled services to Tel Aviv Ben Gurion Airport (TLV). Ground handling at TLV is relevant to BA’s operational chain.

• QAS – Quality Airport Services Israel Ltd. provides ground handling at Ben Gurion International Airport ¹⁵¹⁶. QAS is a joint venture: 50% Swissport International, 50% Knafaim Holdings Ltd ¹⁵¹⁷.
• Knafaim Holdings is a Tel Aviv Stock Exchange-listed Israeli aviation conglomerate (TASE: KNFM) ¹⁸. Its corporate website confirms aviation services businesses including ground services and aircraft leasing through Global Knafaim Leasing ¹⁷¹⁹.
• Prior reporting asserted that Knafaim’s subsidiary “Maintenance Wings” holds contracts to maintain IAF C-130 Hercules aircraft, citing a 2014 Globes article ²⁰. This is a factual error in prior reporting: the Globes article reports that Israel Aerospace Industries (IAI) — not Knafaim or Maintenance Wings — won the NIS 390 million Hercules maintenance contract. Knafaim and Maintenance Wings are not mentioned in connection with that award. The claim that Knafaim holds IAF Hercules maintenance contracts is not supported by the cited source and must be discarded.
• Knafaim’s corporate website lists “Maintenance Wings” as an aviation maintenance entity ¹⁷, but no publicly available source confirms an active military aircraft maintenance contract between Knafaim/Maintenance Wings and the IAF in the post-2020 period.
• What is confirmed: QAS is 50% owned by Knafaim, an Israeli aviation conglomerate listed on TASE. No publicly available BA–QAS contract has been identified, though QAS is a dominant ground handler at TLV and the commercial relationship is operationally standard. The military maintenance supply-chain link is not verified by any source.

Offensive Cyber & Weapons Technology

British Airways is an airline operator, not a technology developer or vendor. It does not develop, sell, or license software of any kind. Not applicable to target. No public evidence identified.

AI, Algorithmic & Autonomous Systems

IAGi / Hangar 51 Accelerator — Israeli AI Startups

British Airways’ parent International Airlines Group (IAG) operates an innovation accelerator programme, historically branded Hangar 51 and now IAGi Ventures / IAGi Accelerator ²¹²². IAG has explicitly stated its intent to engage with the Israeli startup ecosystem, with executives attending Israeli tech events and identifying Israel as a priority innovation geography ²³. IAG’s 2019 accelerator cohort announcement directly referenced Israeli startup participation ²⁴.

The following Israeli-origin AI and algorithmic startups have verifiable connections to Hangar 51 or IAGi programmes:

• RubiQ (Tel Aviv, Israel): An AI-powered flight disruption self-service and rebooking platform. Reported in aviation trade press as a Hangar 51 participant that subsequently obtained contracts with IAG carriers ²⁵. Confirmed: Israeli-origin; Hangar 51 participant; deployment across IAG carriers (including BA) reported in trade press ²⁵, though a specific signed BA contract document has not been independently confirmed via a BA-sourced announcement.

• Evolinq (Israel): AI procurement automation agents. Listed in IAGi’s 2025 accelerator cohort announcement’s “Deploy Track” ²⁶²⁷, which implies a live operational trial with an IAG carrier rather than merely selection for the programme. Confirmed: Israeli-origin; selected for IAGi 2025 Deploy Track — the most advanced programme tier, indicating an active operational relationship with at least one IAG carrier.

• Fetcherr (Israel): Generative AI for airline pricing and revenue management. Fetcherr’s About page lists former British Airways CEO Alex Cruz as a board member ²⁸. This constitutes a governance relationship between a senior former BA executive and an Israeli AI pricing startup. Confirmed: former BA CEO on Fetcherr board. This is a personal governance relationship, not a confirmed BA corporate procurement contract. The distinction is material.

AI/ML Provision to State Bodies

British Airways does not provide AI or ML systems to any state body as a vendor. Not applicable to target. No public evidence identified.

Training Data & Model Development

No public evidence that BA’s AI or algorithmic systems have been trained on surveillance-derived datasets from Israel or occupied territories. No public evidence identified.

Autonomous & Lethal Systems

British Airways is a commercial airline operator. It does not produce autonomous targeting, fire-control, or kill-chain systems. Not applicable to target. No public evidence identified.

Technology Ecosystem & R&D Footprint

IAG Innovation Programme — Israeli Startup Engagement

IAG publicly stated its intent to engage with the Israeli innovation ecosystem in 2019, with coverage in the Jerusalem Post confirming executive participation in Israeli tech scouting activities ²³. The IAGi Accelerator (successor to Hangar 51) selected a record 29 startups for its 2025 cohort ²⁶²⁷, with Israeli-origin companies represented across tracks. The accelerator spans BA and other IAG carriers (Iberia, Vueling, Aer Lingus).

• Biobeat (Petah Tikva, Israel): A wearable, cuffless vital signs monitoring patch. The Jerusalem Post (2019) reported that Biobeat’s co-founder Arik Ben-Ishay conceived the device while serving as an IDF paramedic during Operation Protective Edge (2014) ²⁹. Biobeat reached the Hangar 51 finalist stage and was evaluated for in-flight medical monitoring trials ³⁰²⁵³¹. Confirmed: Israeli-origin; IDF paramedic co-founder; Hangar 51 finalist/trial stage participant. A formal investment or deployment contract beyond the accelerator trial has not been confirmed in a publicly available source.

• Fetcherr (Israel): As noted above — former BA CEO Alex Cruz serves on the board ²⁸, providing a personal executive link between former BA leadership and an Israeli generative AI pricing platform.

• Evolinq (Israel): Deploy Track participant in the 2025 IAGi cohort ²⁶²⁷, representing the programme’s operational tier.

Israeli R&D Facilities

No public evidence that British Airways operates any R&D facility, engineering office, innovation lab, or accelerator programme within Israel. IAG’s scouting and accelerator activities constitute startup engagement, not an R&D facility. No public evidence identified.

Patent & Intellectual Property

No public evidence of patent portfolios, licensing agreements, or co-development arrangements between British Airways and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute). No public evidence identified.

Satavia (UK-origin) — Characterisation Correction

Prior reporting characterised Satavia (a Hangar 51 finalist for environmental AI and contrail management) as having “Israeli ties.” Satavia is a Cambridge, UK-based company. No Israeli connection has been identified in any public source. The characterisation is unsupported and has been discarded.

Civil Society Scrutiny & Regulatory History

Data Breach & ICO Enforcement Action

The most significant public regulatory action against British Airways is the 2018 data breach and the subsequent ICO enforcement. Approximately 500,000 customers were initially reported as affected ³², with the ICO’s investigation ultimately covering approximately 420,000–500,000 individuals ⁵³³. The breach, active from 21 August to 5 September 2018, involved the compromise of BA’s booking website and app, exfiltrating payment card data, names, addresses, and login credentials in transit ³⁴. Attribution of the breach to the Magecart (also characterised as FIN7-linked) threat group was documented by security researchers including RiskIQ and Huntress ³⁴.

The ICO issued a £20 million penalty notice against British Airways on 16 October 2020 ⁵³³, reduced from an initial indicative notice of £183.39 million, partly in consideration of the economic impact of COVID-19 on the airline industry. The ICO found that BA had failed to implement sufficient technical and organisational measures under Article 5(1)(f) and Article 32 of GDPR, specifically including the absence of adequate client-side script integrity controls ⁵⁴. This action is not related to Israeli technology relationships — it concerns BA’s security posture generically.

NGO & Academic Scrutiny

No NGO investigation, academic study, or UN report specifically addressing British Airways’ technology relationships with the Israeli state, Israeli military entities, or surveillance technology suppliers has been identified. The Amnesty International “Ban The Scan” campaign ³⁵ addresses AnyVision/Oosto’s activities in Hyderabad, India, and references its West Bank surveillance operations, but does not name British Airways in any context. Searched resources included Amnesty International, Human Rights Watch, B’Tselem publications index, the BDS Movement official website, Stop the Wall campaign, and the Who Profits database. No public evidence of NGO reports specifically targeting BA’s Israeli tech relationships identified.

Boycott, Divestment & Sanctions (BDS) Campaigns

No organised BDS campaign specifically targeting British Airways for its technology procurement relationships with Israeli entities has been identified in publicly available sources. General Palestine solidarity campaigns have targeted airlines operating to Israel — including British Airways — primarily focused on demands for route suspension rather than technology procurement concerns. No technology-procurement-specific BDS campaign against BA identified. No public evidence identified.

Export Control & Sanctions

No export control actions, sanctions investigations, or legal challenges related to BA’s technology relationships with Israeli state entities have been identified in UK, EU, or US regulatory records. No public evidence identified.

End Notes