Judge Axes Flight Disruption Suit Tied to CrowdStrike Outage

A federal judge on Wednesday dismissed a lawsuit by airline passengers accusing CrowdStrike of negligence and public nuisance for pushing a faulty software update that disrupted airline operations in 2024.

U.S. District Judge Robert Pitman found the plaintiffs’ claims against CrowdStrike were preempted by the Airline Deregulation Act since the harm was tied to airline services such as ticketing, boarding and flight scheduling. Although CrowdStrike is a cybersecurity vendor and not an airline, Pitman determined that the ADA still applied because CrowdStrike’s faulty software update directly affected airline services.

“Nothing suggests CrowdStrike’s services are tenuous or peripheral,” Pitman wrote in an 11-page order Wednesday. “They argue that airline passengers and customers, ‘Relied on CrowdStrike’s performance of its ongoing services to keep CrowdStrike’s airline customers’ airplanes flying as scheduled.’ By Plaintiffs’ own allegations, the services CrowdStrike offers are core to the provision of airline services.”

The proposed class action lawsuit, filed by plaintiffs Julio del Rio, Jack Murphy, Steven Bixby, Alicia Kirby, Philip Kirby, Jennie Aguayo, Christopher Harlan, Sara Harlan and “tens of thousands of other travelers were left stranded in airports for hours or days,” is one of many legal claims CrowdStrike faces after a faulty July 2024 software update to the company’s Falcon platform disrupted 8.5 million systems. In one lawsuit, brought by client Delta Airlines, Georgia judge last month ruled that Delta can proceed with most of its lawsuit, in which it accused CrowdStrike of pushing the software update without Delta’s permission and bypassing Microsoft’s certification (see: Judge Lets Delta Lawsuit Over CrowdStrike Outage Proceed).

Why the Airline Deregulation Act Also Applies to CrowdStrike

In dismissing the airline passengers’ claims, the court adopted a broad interpretation of services under the Airline Deregulation Act, including items like ticketing, boarding and baggage handling. Pitman said the plaintiffs’ allegations, which centered on the consequences of delayed and canceled flights, clearly related to these types of services. Even though the lawsuit was directed at CrowdStrike, he ruled the harm was fundamentally tied to airline operations.

“To prevent a patchwork of inconsistent state laws governing the airline industry, Congress included a preemption provision in the ADA, which expressly preempts state-law claims related to airline services, like plaintiffs’ claims,” Pitman wrote in an order. CrowdStrike Chief Legal Officer Cathleen Anderson said Thursday. “We are grateful for the court’s thoughtful consideration and decision to dismiss this case.”

The plaintiffs accused CrowdStrike of negligence for failing to adequately test the software update, failing to warn customers and general recklessness in deploying a defective update. Several plaintiffs alleged personal injuries including migraines, stress or physical ailments because of the travel chaos. Others cited economic damages such as lodging costs, missed work, transportation and replacement flights.

“The risk of an outage stranding travelers was foreseeable in light of CrowdStrike’s situational knowledge, its previous experience, and its testing and implementing software updates,” the plaintiffs wrote in April. “CrowdStrike’s undertaking to control updates to its customers’ computers directly and regardless of customers’ computer settings and its resulting control over those updates each give rise to negligence duties.”

Since CrowdStrike is a third-party software vendor rather than an airline, the plaintiffs said the company shouldn’t benefit from Airline Deregulation Act preemption. But the court found that CrowdStrike’s software update directly interfered with critical airline systems – affecting customer check-in, weight calculations and communications – which tied the alleged misconduct tightly to airline services.

“Plaintiffs argue that CrowdStrike does not provide a service ‘related to’ airline rates, routes and/or services because CrowdStrike is a cybersecurity firm offering the same services across other sectors,” he said. “But ‘ADA preemption is not limited to claims brought directly against air carriers.’ Rather, claims against entities other than airlines may also be preempted when they relate to an airline ‘price, route or service.'”

Why the Judge Said CrowdStrike Didn’t Run Afoul of State Law

Not all third-party conduct tangentially related to airline operations is subject to ADA preemption, with actions such as environmental regulation violations or employment discrimination falling outside the ADA’s purview. But according to the plaintiffs’ own complaint, Pitman said airlines “relied heavily on cyber and network support” provided by CrowdStrike, and passengers were directly affected when this failed.

“This is not akin to an employment discrimination suit or an environmental regulation, where courts have found only a tenuous or peripheral connection to airline services,” wrote Pitman, a judge in the Austin Division of the Western District of Texas, which is where CrowdStrike is based.

The court warned that permitting tort actions against vendors whose services affect airline operations could result in de facto state regulation of federally governed systems. If such lawsuits were allowed, cybersecurity vendors might be forced to adjust their practices or pricing models specifically for airlines. Pitman viewed this as a significant effect on airline services that ADA preemption is meant to forestall.

“Airlines would experience significant effects from the enforcement of state tort law in this manner on CrowdStrike, because cybersecurity vendors would have an incentive to change their practices and services for airlines specifically,” Pitman wrote in the order Wednesday. “The vendors would also likely have a strong incentive to charge more for their services to offset that risk of liability.”

The plaintiffs attempted to salvage part of their case by pointing out that some class members suffered personal injuries, including anxiety, headaches and physical stress. But the crux of the case was rooted in airline service disruptions, not in the type of personal harm excluded from ADA preemption, Pitman said. Even personal injury claims could not escape the broad sweep of federal preemption in this case.

“Plaintiffs do not claim they were injured because of how an aircraft was operated or maintained,” Pitman said. “Rather, because their claims concern the airlines’ services and would have an impact on future service operations, they are preempted.”