EU aviation security law explained: Regulation 300/2008 and 2015/1998

Why do you have to take off your belt at the airport, why does security patrol the fence, and why can’t you get an airport pass without a background check? The answer lies largely in two EU legal acts: Regulation (EC) No 300/2008 and Implementing Regulation (EU) 2015/1998. This article explains, without legalese, how this European legal framework of aviation security is built, who regulates what, what of it is public – and what it all means for you as a spotter.

The short answer

Regulation 300/2008 sets out what has to apply in the EU for the security of civil aviation: common basic standards, responsibilities, security programs and inspections. The European Commission’s Implementing Regulation 2015/1998 sets out how this is implemented in detail. As EU regulations, both apply directly in all member states – no implementing law is needed for that. National rules such as the German Aviation Security Act supplement the framework, for instance on responsibilities and the powers of authorities.

Security is not safety

In German, “Sicherheit” carries two meanings; in English it does not. Safety means technical and operational safety: airworthiness, maintenance, pilot licenses, air traffic control. Security means protection against deliberate attacks – the regulation speaks of “unlawful interference” with civil aviation.

Regulation 300/2008 clearly belongs to security. Anyone who wants to know why an airline may not fly in the EU is in the right place with the EU air safety list, not here. The passenger rights under Regulation 261/2004 are also a topic of their own. Here it is about checkpoints, fences, passes and screening.

How it came about

Until the early 2000s, aviation security in Europe was largely a national matter, based on the international standards of ICAO. After the attacks of September 11, 2001, the EU created its first common rules with Regulation (EC) No 2320/2002. They were tightened several times in the following years – the best-known example being the quantity limits for liquids in cabin baggage, introduced after an attack plot foiled in Britain in 2006.

With Regulation 300/2008 of March 11, 2008, the EU replaced and reorganized this first framework. It entered into force twenty days after its publication but only became fully applicable together with the accompanying implementing provisions; that was the case from the end of April 2010. The detailed rules were initially in Regulation (EU) No 185/2010. This was replaced by Implementing Regulation 2015/1998 of November 5, 2015, which has applied since February 1, 2016 and has been amended repeatedly since.

Legal act	What it is	Role today
Reg. (EC) 2320/2002	first common EU rules after 9/11	historical, repealed by 300/2008
Reg. (EC) 300/2008	framework regulation by Parliament and Council	valid basic framework
Reg. (EC) 272/2009	supplements the general basic standards	valid, amended several times
Reg. (EU) 72/2010	procedures for Commission inspections	valid
Reg. (EU) 185/2010	first implementing regulation	historical, repealed by 2015/1998
Impl. Reg. (EU) 2015/1998	detailed implementing measures	valid, amended regularly

What is in Regulation 300/2008

The framework regulation is surprisingly short. Its 24 articles mainly regulate structures and responsibilities; the actual security standards are in the annex. The most important building blocks:

• Objectives and scope (Art. 1 and 2): common rules to protect civil aviation from unlawful interference, applied to airports in the EU, to air carriers offering services there and to all entities implementing security standards in the process.
• Definitions (Art. 3): This is where definitions such as airside, landside and security restricted area are found – more on that shortly.
• Basic standards (Art. 4 with Annex I): the core, divided into twelve chapters.
• More stringent measures (Art. 6): Member states may go beyond the basic standards if a risk assessment justifies it and the measures are relevant, objective, non-discriminatory and proportionate. They must inform the Commission.
• Competent authority and programs (Art. 9 to 14): Each state designates a competent authority and establishes a national security program and a quality control program. Airports, airlines and other entities, for example in the cargo chain, need their own security programs.
• Inspections (Art. 15): The Commission itself checks whether states and airports comply with the rules.
• Publication (Art. 18): What directly concerns passengers is published. Sensitive details remain classified.
• Penalties (Art. 21): The member states determine what penalties threaten for violations.

The twelve chapters of the basic standards

Annex I of Regulation 300/2008 and the annex of Implementing Regulation 2015/1998 are structured identically. So if you read in a chapter of one regulation, you find the details under the same number in the other.

Chapter	Topic	What it covers
1	Airport security	zones, access control, screening of staff and vehicles, surveillance and patrols
2	Demarcated areas	separation of areas with differing measures
3	Aircraft security	search or check of aircraft, protection against tampering
4	Passengers and cabin baggage	screening of all departing, transferring and transit passengers
5	Hold baggage	screening before loading, protection, matching to the passenger
6	Cargo and mail	security controls, regulated agents and known consignors
7	Air carrier mail and materials	screening and protection until loading
8	In-flight supplies	catering and other goods for use on board
9	Airport supplies	goods for shops and restaurants in the security restricted area
10	In-flight security measures	protecting the cockpit, handling disruptive passengers
11	Staff	recruitment, training, certification
12	Security equipment	requirements for screening devices

The zones at the airport

For spotters, Article 3 with its definitions is the most interesting part, because it describes where you are standing. Chapter 1 requires every airport to set up at least these areas:

• Landside: all areas and buildings of an airport that do not belong to airside – access roads, parking garages, public terminal areas.
• Airside: the movement areas of the airport together with adjacent land and buildings to which access is restricted.
• Security restricted area: the part of airside in which further security standards apply in addition. Anyone who wants to get in is screened.
• Critical parts of the security restricted area: especially protected zones, such as where screened passengers and baggage move.

How these boundaries run at real airports and why the fence is often not the only boundary is shown in more detail in the article Landside, airside, security restricted area.

Chapter 1 in detail: access, passes, patrols

Chapter 1 is the part that touches spotters most directly. Four points are in it:

Access control. Unauthorized persons have no access to airside, and access to the security restricted area is controlled. Anyone who may move around there unescorted needs a pass. It is issued only after a background check, that is, a documented check of identity including criminal record – this expressly also applies to flight crews. A security training also has to be completed beforehand.

Screening of other persons. It is not only passengers who are screened. Staff, visitors and everyone else who goes into the security restricted area are searched too – according to the basic standard at least continuously on a random basis, every time when entering critical parts. That also affects you if you take part in an official spotter tour or spotter program on the apron.

Vehicles. Vehicles that enter the security restricted area are checked for prohibited items.

Surveillance and patrols. Airports have to monitor and patrol their grounds – and expressly, where appropriate, also adjacent publicly accessible areas. The aim is to detect suspicious behavior and identify weak points. That is exactly why security staff sometimes stop next to you at the fence. How best to react then is described in the article When security comes over.

What is public and what stays secret

Anyone who reads Implementing Regulation 2015/1998 finds a surprising amount of detail – but not everything. Article 18 of the framework regulation separates clearly:

• Measures with a direct effect on passengers are published by the Commission. These include, for example, the lists of prohibited items for cabin baggage and hold baggage.
• Sensitive security information on certain measures and the Commission’s inspection reports, including the authorities’ replies, are treated as EU classified information.

The secret parts are therefore not in the publicly accessible regulation but in a separate Commission decision that is accessible only to authorities and the bodies concerned. The logic behind it: anyone who knows exactly how often and how randomly checks are carried out can exploit that. That is also the background to why photographing at the security checkpoint is expressly prohibited at many airports.

Who checks the checkers?

The EU system has three levels of review:

The Commission reports regularly to Parliament and Council on the results. The individual inspection reports, however, remain confidential – see above.

Scope: the EU and more

The rules do not apply only in the EU states. According to the European Commission, Norway, Iceland, Liechtenstein and Switzerland also apply them. Anyone spotting in Switzerland therefore meets the same basic structure of zones and checks; the local particularities are described in the article Plane spotting in Switzerland.

For third countries, the regulation provides the possibility of recognizing their standards as equivalent. The principle of “one-stop security” is based on this: anyone coming from such a country and transferring in the EU does not have to go through screening again. The Commission names the USA, Canada and Montenegro as examples. Conversely, third countries may require their own additional measures for flights into their territory; Article 7 governs how the EU deals with this.

And Germany?

In Germany, the Aviation Security Act (LuftSiG) supplements the EU requirements. Among other things, it regulates which authorities are responsible, how the background check works and which duties airport operators and airlines have under German law. In practice, the actual checks at the airport are often carried out by private service providers on behalf of the authorities – with staff trained and certified under the requirements of Chapter 11. What this job looks like is explained in the article Becoming an aviation security screener.

Anyone who enters airside without authorization is not violating an abstract EU norm but concrete national criminal and administrative-fine provisions – because Article 21 of the regulation leaves penalties to the member states. What is at stake is described in the article Trespassing on airport grounds.

What all this means for you as a spotter

The good news first: EU aviation security law contains no ban on photography. Whether you may take photos in a place is decided mainly by the airport operator’s house rules, local use regulations and national laws. An overview is offered by the article Is plane spotting allowed?.

Indirectly, though, the EU framework clearly shapes your hobby:

That surveillance does not automatically mean conflict is shown by initiatives in which airports and police work together with spotters – more on that in the article Spotters as security partners. If you stay calm, stand visibly on public ground and answer questions openly, you rarely have problems. The basic rules for that are summarized in Proper behavior at the airport fence.

Flying with a camera

As soon as you fly yourself, you are a passenger in the sense of Chapter 4: you and your cabin baggage are screened. For camera, batteries and lenses, the published lists of prohibited items apply plus the airline’s rules. The rules for liquids have been adjusted several times in recent years with new CT scanners and differ depending on the departure airport – check your airport’s information before every trip. You will find practical packing tips under Camera gear in cabin baggage.

What to keep in mind

• Read the consolidated version. Both regulations have been amended many times. On the EU legal portal EUR-Lex there are consolidated versions that incorporate all amendments – only those are meaningful.
• Not everything is in there. If a detail is missing, it may be regulated in the non-public parts. You should not draw conclusions about gaps in screening from that.
• National rules can be stricter. A member state or airport may go beyond the EU standard. What is allowed at one airport does not automatically apply at the next.
• Keep terms clearly separate. Security (protection against attacks) and safety (operational safety) are different areas of law with different authorities.
• Respect boundaries. Fences, barriers and signs mark airside. Anyone who crosses them interferes with the core of this legal framework – with correspondingly serious consequences.

Conclusion

The European legal framework of aviation security has two levels: Regulation 300/2008 sets objectives, basic standards and responsibilities, Implementing Regulation 2015/1998 supplies the details – both in the same twelve-chapter grid. This is supplemented by national laws, security programs of airports and airlines and a non-public part with sensitive details. For spotters, Chapter 1 is the most relevant: it defines the zones, regulates access and obliges airports to keep an eye on their public surroundings too. The framework does not forbid photography – but it explains why someone sometimes asks questions at the fence.