Digital Domain Audit: British Airways plc

Target: British Airways plc (Harmondsworth, UK) Parent: International Airlines Group (IAG) Domain: Digital (Digital / Technology) Date: June 2026 Scope: British Airways’ own digital/data/cyber/surveillance/AI conduct re Israel. IAG group-level tech is attributed to IAG, not British Airways.

Enterprise Technology Stack & Vendor Relationships

British Airways runs a predominantly Western-vendor enterprise stack with no Israeli-origin core supplier identified. In 2024 BA selected Amadeus (Madrid, Spain) as a strategic technology partner, adopting the Amadeus Nevio portfolio for its Offer and Order strategy and completing a cutover to Amadeus Network Revenue Management.¹ BA has used Salesforce (US) Sales Cloud as its core B2B CRM since 2014, consolidating its global B2B sales onto the platform.² Customer-service transformation has been delivered with Sabio Group (UK) on an “Intent Capture & Analysis” data strategy, and BA has stated it will use bespoke Microsoft (US) Connected/Teams software for customer support.³⁴

BA’s long-running IT services partner is Tata Consultancy Services (TCS, India), described by TCS as a multi-decade relationship; the BA-TCS engagement is delivered from India and UK locations.⁵ BA’s payroll was processed by Zellis (UK), whose compromise exposed BA staff data in 2023 (see below).⁶

No public evidence identified of an Israeli-domiciled or Israeli-headquartered enterprise software, biometric, or data vendor in British Airways’ own technology stack. Where vendors have Israeli-founded heritage but are US- or EU-domiciled, they are treated here as US/EU vendors.

Parent-level context: IAG operates a shared group technology function (IAG Tech) and IAG Loyalty (which runs the Avios currency underpinning the British Airways Club / Executive Club); these are separate IAG entities, and group-level deals (e.g. an AWS-Iberia cloud arrangement) are not attributed to BA here.⁷

Surveillance, Biometrics & Retail Technology

British Airways was an early adopter of facial-recognition biometric boarding. From 2017 onward BA rolled out biometric boarding gates, first on US-bound services in partnership with US Customs and Border Protection at Orlando, Los Angeles and New York, then on domestic UK departures from Heathrow Terminal 5.⁸⁹ BA has reported hundreds of thousands of customers using biometric boarding, and described all domestic Terminal 5 departures as biometrically boarded.⁹¹⁰

The biometric boarding gate technology BA deployed was supplied by Vision-Box, a company founded in 2001 and headquartered in Oeiras, Portugal.¹¹ Vision-Box was owned by France-based private-equity firm Keensight Capital and, in 2024, was acquired by Amadeus (Spain) for an enterprise value of approximately €320 million.¹¹¹² No public evidence identified of Israeli ownership, Israeli-domiciled R&D, or an Israeli defence/security supply chain behind the Vision-Box biometric system BA used.

No public evidence identified of British Airways deploying Israeli-origin facial-recognition, behavioural-analytics, or in-store/retail surveillance technology in its own operations.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

British Airways is undertaking a large cloud migration as part of a £7 billion transformation programme, with roughly £750 million earmarked for IT infrastructure and a stated plan to migrate around 700 systems and thousands of servers to the cloud.¹³¹⁴ BA publicly operates substantial Amazon Web Services (US) infrastructure, with reports of more than 1,000 AWS production accounts under management.¹⁵ BA has also run a Microsoft (US) Copilot trial from 2025 across dozens of internal use cases.¹⁶

BA has not publicly disclosed a single named primary cloud provider for the full 700-system migration, and the carrier has not publicly stated which datacentre regions or sovereign-cloud partitions host its passenger or loyalty data.¹⁴

No public evidence identified of British Airways participating in any Israeli sovereign-cloud programme, hosting data in Israeli datacentres, or contracting Israeli cloud-infrastructure providers. BA’s disclosed cloud relationships are with US hyperscalers (AWS, Microsoft).¹⁵¹⁶

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of British Airways holding technology contracts with, or supplying digital services to, Israeli defence, military, intelligence, or homeland-security bodies.

No public evidence identified of British Airways procuring cyber-intelligence, lawful-intercept, mobile-exploitation (e.g. NSO Group / Pegasus-type), or surveillance tooling from Israeli vendors. A 2017 UK Government / UK-Israel Tech Hub initiative that took Israeli cyber firms to UK corporates named Aviva, BT, Goldman Sachs, RBS and Visa as participants; British Airways was not among the named companies.¹⁷

British Airways’ security-relevant biometric deployments operated in cooperation with US Customs and Border Protection (a US federal agency), not with any Israeli authority.⁸

AI, Algorithmic & Autonomous Systems

British Airways’ £7 billion transformation includes roughly £100 million earmarked for automation, AI and machine learning across operations “from booking to baggage handling.”¹³¹⁸ BA has described AI-driven business transformation and operational tooling, and ran a Microsoft Copilot trial from June 2025 covering use cases such as RFP automation, HR-policy agents and email prioritisation.¹⁶¹⁸ BA’s customer-service AI work has been delivered with Sabio Group (UK).³

The AI/ML platforms BA has publicly associated itself with are those of US vendors (Microsoft, and the AWS environment it operates).¹⁵¹⁶ No public evidence identified of British Airways using Israeli-developed AI, algorithmic targeting, or autonomous-systems technology, or of BA contributing data or funding to Israeli AI research.

Technology Ecosystem & R&D Footprint

British Airways’ disclosed technology and digital-product development is centred on the UK (its Heathrow/Harmondsworth base and ba.com digital products) and on its India-based services partner TCS.⁵¹⁹ BA’s transformation narrative references rebuilding the ba.com website and mobile app, a BETA browser experience, and deeper personalisation, but locates this work within its UK operation and existing vendor relationships rather than a named overseas innovation lab.¹⁹

No public evidence identified of British Airways operating an innovation hub, R&D centre, accelerator, or venture/startup investment programme located in Israel, nor of BA holding equity in Israeli technology startups in its own name (as distinct from any IAG group-level activity, which is attributed to IAG, not BA).

Civil Society Scrutiny & Regulatory History

British Airways has a significant data-protection and cyber-incident record, though none of the public scrutiny ties to Israel. In the 2018 Magecart web-skimming attack, malicious JavaScript injected into BA’s website and app diverted the payment-card data of roughly 429,612 individuals (including around 244,000 customers’ card numbers, expiry dates and CVVs); the attacker entered via compromised third-party-supplier credentials and a Citrix-based remote-access path.²⁰²¹ The breach was linked to Magecart by security firm RiskIQ and others.²⁰ The UK ICO initially announced an intention to fine BA £183.39 million under GDPR, later reduced to a £20 million penalty issued in October 2020.²²²³ The incident also generated a large UK group-litigation claim.²⁰

In June 2023 BA staff data was exposed via the MOVEit Transfer zero-day (CVE-2023-34362) exploited by the Cl0p ransomware group against BA’s payroll provider Zellis (UK), part of a wide supply-chain campaign also hitting the BBC and Boots.⁶²⁴ No public evidence identified of any specific forensic or incident-response firm being publicly named by BA for the 2018 breach beyond generic references to external cybersecurity consultants; no Israeli forensic, attribution, or remediation vendor was identified in connection with either incident.²¹

No public evidence identified of NGO, BDS, parliamentary, or regulatory scrutiny of British Airways specifically concerning Israeli technology, data transfers to Israel, or surveillance-tech procurement. BA’s suspensions and resumptions of Tel Aviv (Ben Gurion) services since October 2023 are commercial/security route decisions and fall outside the digital domain.²⁵

End Notes