Key facts
- The FAA has not completed risk assessments and updated security documentation for aircraft communication threats like spoofing and jamming.
- The agency lacks real-time detection capabilities for all spectrum-related threats.
- Hackers could transmit fraudulent clearance cancellations, potentially causing flight delays or safety issues.
- A July 2026 GAO report identified weaknesses in the FAA's cybersecurity planning, budget reporting, and Zero Trust implementation.
- Vulnerabilities exploited across aviation systems include poor software patch management and outdated operating systems.
The Federal Aviation Administration (FAA) must improve its security measures against threats like spoofing and jamming to aircraft communications, a government watchdog said. The Government Accountability Office (GAO) reported that the FAA has not completed necessary risk assessments and updated security documentation to counter these threats, and lacks real-time detection capabilities for all spectrum-related risks.
Malicious actors could potentially transmit fraudulent clearance cancellations, which could lead to flight delays or compromise aviation safety, according to the GAO. A separate GAO report from July 2026 highlighted significant shortcomings in the FAA's aviation cybersecurity program, pointing to issues in planning, budget reporting, and the implementation of Zero Trust architecture. Vulnerabilities across aviation systems include inadequate software patch management, outdated operating systems, and insecure supply chains.
Separately, the FAA announced Monday it was temporarily halting some incoming flights into Philadelphia, Newark Liberty, and Teterboro, New Jersey, airports due to air traffic control communications issues. The problem is tied to frequencies at a Philadelphia air traffic control facility. Flight tracking sites reported over 600 flights delayed at Newark and Philadelphia, with average delays of 112 minutes at Newark. The FAA and the Transportation Security Administration (TSA) have improved their collaboration through the Aviation Cybersecurity Initiative, but critical gaps persist.