The best Delta customers can hope for is a simple refund

Delta is still canceling and delaying flights days after the botched CrowdStrike update.

• Delta is still canceling and delaying flights days after the botched CrowdStrike update.
• Customers can expect a refund at best, legal experts say.
• "Airline passengers have very few rights," a former Transportation Department inspector general said.

After Friday's global meltdown caused by a botched CrowdStrike software update, most airlines rescheduled the vast majority of flights and have largely resumed normal operations.

Except for Delta.

The airline is still struggling to repair its computer systems. According to FlightAware, it canceled 466 flights Tuesday, more than any other airline in the world.

The best Delta customers can hope for is a refund.

Compensation policies for cancellations and delays are in the fine print of contracts between airlines and customers buying tickets. They're further governed by the Federal Aviation Administration within the US Department of Transportation.

Transportation Secretary Pete Buttigieg categorized the CrowdStrike failures — caused by a bug in an update to its Falcon security software on Microsoft Windows computers — as a "controllable" failure, which means the airlines are responsible for compensating customers for canceled flights.

The "controllable" designation means airlines have more responsibilities than if there were delays or cancellations due to weather or some other "force majeure" issue, according to Mary Schiavo, a former Department of Transportation inspector general.

"The airline is responsible for refunds, rebooking, delays, et cetera," Schiavo, now an aviation law attorney at Motley Rice, told Business Insider. "And then that means that any payments that you're entitled to under federal aviation regulations for the delay would kick into effect."

Those refunds also must include any additional fees, like for luggage or seat designation, Schiavo said.

Airlines are also responsible for some compensation for delays, the amount of which varies depending on the airline and the amount of delay, Business Insider previously reported. If customers reject rebookings that airlines offer, they're entitled to a "prompt refund," Schiavo said.

According to Schiavo, Buttigieg's "controllable" designation made sense. The CrowdStrike failure was akin to an aircraft equipment failure, where the airline is responsible for proper maintenance, she said.

"When they have an airplane gets taken out of service, that airline owes the passengers all the rights and things that they're entitled to because their equipment failed," she said. "This is no different than an airplane being broken down."

Customers can take airlines to small claims courts in cities where the companies are based, but bringing lawsuits would likely be pointless, Schiavo said. Federal aviation regulations protect airlines from being sued for "consequential damages," like missed business meetings or medical appointments, she said.

"Airline passengers have very few rights," she said.

The best bet for frustrated customers is to just deal with customer service rather than resort to courts, according to Justin T. Green, an aviation law attorney at Kreindler LLP, who said he personally suffered through Delta delays on a trip this past weekend.

American regulations differ from those in Europe, which require airlines to compensate customers for delays. For airline customers in the US, Green recommended keeping receipts for tickets, cabs to connecting flights, and other expenses that Delta may reimburse for rebooked flights. But they can't get money for their time.

"It's really to make sure you're whole financially," said Green, who is also a licensed airplane and helicopter pilot. "They're not going to be able to give you your time back."

Mark Dombroff, an aviation attorney at Fox Rothschild, said the Department of Transportation's "controllable" designation was "inappropriate and unfair" to airlines, which he said were victims of CrowdStrike. Ordinary airline customers, he said, ought to consult their travel insurance policies.

"These have to do with computer systems," he said. "These are not airline-generated delays, cancellations, or anything. And maybe the DOT has no role in this."

As for CrowdStrike, its standard terms and conditions limit liability to "fees paid" — basically, a refund for its services — for companies that use it. Large companies like Delta may have negotiated individualized terms with CrowdStrike, or may rely on cyber insurance for situations like the software update disaster.

On Tuesday, Buttigieg announced the Department of Transportation's Office of Aviation Consumer Protection was investigating Delta's flight delays.

"We remain entirely focused on restoring our operation after cybersecurity vendor CrowdStrike's faulty Windows update rendered IT systems across the globe inoperable," Delta said in a statement provided to Business Insider following the investigation announcement. "Across our operation, Delta teams are working tirelessly to care for and make it right for customers impacted by delays and cancellations as we work to restore the reliable, on-time service they have come to expect from Delta."

But even if the agency issues any fines, customers won't see a penny.

"Fines go to the government," Schiavo said. "They don't go to the passengers."