Officials tie FAA ground stop to contractor router work, not hackers, but the specific fault is still undetermined

Editor’s Note: The Federal Aviation Administration (FAA) issued a ground stop covering departures nationwide shortly before 4 p.m. EST on Nov. 13, 2026, and Transportation Secretary Sean Duffy said the airspace reopened at 8:15 p.m., though some international departures were cleared. On Nov. 14, Duffy said officials believe a router flood that began during copper-to-fiber maintenance by contractor L3Harris Technologies at a remote FAA site disrupted aircraft communications and some radar feeds. Officials said they do not believe it was a cyberattack, but Duffy said they have not determined whether installer error or faulty equipment was to blame. L3Harris said it is supporting the FAA investigation; its statement does not address Duffy’s account.

For cybersecurity, information governance and eDiscovery professionals, the episode shows how a routine change can draw a national security response, why change records and device logs can decide fault, and why early statements ruling out an attack carry risk. In 2023, the FAA kept its attack assessment scoped to the evidence throughout; this week, Microsoft and U.S. officials each began that way and moved to categorical denials within about a day, before any formal root-cause finding. Watch for an FAA root-cause finding and Congress’s funding response.

News Analysis – Cybersecurity Beat

Officials tie FAA ground stop to contractor router work, not hackers, but the specific fault is still undetermined

ComplexDiscovery Staff

At 3:36 p.m. EST on Friday, Nov. 13, radar and communications data at air traffic facilities across the United States began producing inconsistent readings, according to Transportation Secretary Sean Duffy. Shortly before 4 p.m., the Federal Aviation Administration (FAA) issued a ground stop covering departures nationwide. By Saturday, officials said they did not believe a foreign attacker was involved and pointed instead to router work during a copper-to-fiber changeover at a remote site, while saying they had not yet pinned down the specific fault.

The ground stop lasted over four hours. At a White House briefing Friday night, Duffy said the airspace had reopened at 8:15 p.m. and warned that the recovery would be slow. The halt was not absolute: the Port of Seattle said some flights to destinations outside the country were cleared to leave Seattle-Tacoma International Airport during the stop. AeroTime and NPR both reported that it was the country’s second nationwide ground stop since the Sept. 11, 2001, attacks, and AeroTime noted that the previous one came in January 2023. FlightAware recorded 7,468 delays and 9,201 cancellations within, into or out of the United States on Friday, and NPR reported Cirium data showing over 4,000 cancellations on Saturday morning.

For cybersecurity, information governance and eDiscovery teams, the episode is less an aviation story than a case study in what happens when a change fails at scale. The failure drew in the FBI, the National Security Agency (NSA) and the White House Situation Room before officials pointed to a maintenance explanation. If that explanation holds, the evidence that settles fault is likely to sit in change records and vendor logs rather than in malware samples.

How officials explained the failure

Those records will be read against two accounts that Duffy gave over two days, both published by the Department of Transportation (DOT). On Friday, he told reporters at the White House that the FAA’s analog telecommunications switches and routers “got overloaded with data” and began returning inconsistent information, so the agency shut the system down. Newer internet protocol switches did not fail, he said: “It’s the old hardware that went down.”

On Saturday, appearing with FAA Administrator Bryan Bedford, Duffy was more specific. He said a contractor doing routine maintenance in “at least one” remote FAA location was moving lines from aging copper wire to fiber. Through either contractor error or faulty equipment, the router involved then began flooding other routers in the air traffic control system with over 1,000 connection attempts every four to five seconds, he said. That flood disrupted communication with aircraft and some radar feeds. “We haven’t determined what the fault was,” Duffy said.

He named the contractor as L3Harris Technologies, which he said owns the legacy network the FAA uses to control the airspace. In a statement posted Nov. 14, L3Harris said it is “supporting the FAA in its investigation to understand the conditions that led to the Nov. 13 ground stop.” The company said that, together with its telecommunications partners and the FAA, it has completed over 70 percent of the planned move from legacy copper to fiber optics. The four-sentence statement does not address Duffy’s account of what failed.

Before Saturday’s briefing, reports relying on unnamed sources had described the trigger as an update. SecurityWeek, relaying Bloomberg, reported Nov. 14 that the FBI did not believe an attack or a crime was behind the outage and was examining whether a software update was to blame. Relaying CBS News, SecurityWeek also reported that the failure came after an update to the private network tying the air traffic control system together, and that the network restarted and then went down. As of Nov. 15, the FAA’s general statements page carries only its Nov. 13 notice citing “communication issues impacting multiple Air Route Traffic Control Centers,” and neither the FAA nor DOT has published a root-cause finding.

Why the national security apparatus mobilized

The uncertainty was greater still while the outage unfolded, and the speed of the spread briefly lifted the problem to the top levels of government, Fortune reported. Bedford said Saturday that the White House Situation Room and the national security apparatus had been mobilized and that FBI personnel were in FAA facilities, according to Fortune. Duffy said, according to Fortune, that a conference call that included FBI Director Kash Patel, the director of national intelligence and the Defense Department was driven by concern that another country had attacked. On Friday, Homeland Security Secretary Markwayne Mullin said the NSA, the Defense Department and the Cybersecurity and Infrastructure Security Agency were part of the response, according to a Homeland Security Department release.

Officials’ public assessments firmed up in about a day. On Friday, Mullin kept his language tied to the evidence. “We have seen zero evidence that this is a cyberattack,” he said, according to the department’s release, and he told reporters investigators were “not going to rule that out,” SecurityWeek reported. By Saturday, Fortune reported, Bedford said he thought officials had all concluded it was not a cyber issue, and Duffy said officials were comfortable that the remote work was the root cause. In DOT’s account of the same briefing, Duffy said that once the remote work was isolated, all systems came back online, “so, we don’t believe this was cyber at all.”

A routine change that looked like an attack

What officials described instead was routine upkeep. Bedford said the FAA spends $1 billion a year sustaining its existing 1980s telecommunications network and is constantly replacing 2,000 older routers with new ones. He called the swap “ordinary course-of-business stuff” that is not part of the $12.5 billion modernization effort. Duffy added that remote changeovers are done during the day because small sites “shouldn’t have that kind of impact,” and he said the timing of such work would be reevaluated.

That combination carries a lesson for any organization running critical systems. A change that is routine for the team making it can still produce a failure that, in its first hour, responders may not be able to distinguish from hostile activity. Change windows, rollback plans and impact assessments sized for a small site assume the change stays local, and this one, by Duffy’s account, did not.

The same week offered a parallel outside aviation. A global Microsoft 365 outage that began midday Thursday, Nov. 12, disrupted Outlook, Teams and other services until Microsoft said on Saturday that service had been fully restored, the Associated Press reported. Microsoft said the problem had been introduced during an earlier network capacity upgrade and surfaced after a more recent network change, according to AP. The company has promised a post-incident report on the root cause. Its public statements on the attack question followed a path that the government’s would echo, a pattern taken up below. Officials said the Microsoft outage was unrelated to the FAA ground stop, SecurityWeek reported.

Where the evidence lives

For incident responders, both episodes raise a practical question about where the evidence sits. In an outage that may trace to a change, the records that matter most typically include the change ticket and approval, the before-and-after configuration, device logs and the vendor’s network telemetry. In the FAA’s case, some of that material could sit with the contractor rather than the agency, though where these particular records are kept, and who holds them, has not been reported. Response plans that start collecting evidence only once compromise is suspected can overlook those operational records, which show what changed rather than who got in.

Duffy’s warnings to the contractor raise the stakes for preservation. He promised accountability and said L3Harris, or whichever company supplied the router, has to perform better, Fortune reported. Once litigation is reasonably anticipated, a litigation hold suspends routine deletion of potentially relevant information for the identified custodians and data sources, which here could include change records and device logs. Whether a party must preserve records a vendor holds generally turns on whether the party has control over them, such as a contractual right to obtain them, and that test varies by jurisdiction.

The risk of ruling out an attack early

What an organization says in the first days can matter as much as what it keeps, and the FAA’s handling of its last nationwide stop shows what cautious wording looks like. On Jan. 11, 2023, the agency said its preliminary work had traced the Notice to Air Missions system outage to a damaged database file and that, “at this time, there is no evidence of a cyber attack.” Eight days later, a preliminary review supplied the human detail behind that file: contract personnel had unintentionally deleted files while fixing a sync problem between the live primary database and its backup. Through both statements, the FAA said only that it had found no sign of an attack so far.

That wording held up because it claimed only what the agency knew, and the technical account grew more specific without the first statement having to be withdrawn. This week, both organizations started the same way and then moved further. Early Friday, Microsoft’s status page told customers that “at this time, we have no evidence of malicious activity associated with this incident,” SecurityWeek reported. Later that day, in an apology, the company said the outage was not related to cyber, AP reported. Officials on the ground stop went from Mullin’s evidence-scoped Friday remarks to Duffy’s categorical statement on Saturday. “It wasn’t a foreign actor,” Duffy said, according to Fortune, even as he acknowledged that the specific fault had not been identified. Neither organization had yet issued a formal root-cause finding. Both conclusions may well hold. For companies, the lesson sits in the switch, because moving from no evidence so far to no attack at all is a decision worth making deliberately. When a public statement, regulatory filing or customer notice calls an incident non-malicious before the investigation closes, scoped language that limits the finding to what is known so far leaves room to update. Categorical language can become the sentence a regulator or plaintiff later reads back.

What to watch next

The FAA has not said when it will publish a root-cause finding, and Duffy has tied the outage to his push for full funding of air traffic control modernization. In a letter to lawmakers this week, Duffy and White House budget director Russell Vought asked for another $30.1 billion, including $10.1 billion for air traffic control modernization, according to AeroTime and Reuters. Reuters reported that the request came Friday, while The Epoch Times described the letter as dated Nov. 12. Late Friday, after the ground stop, the administration raised its air traffic control request to $50 billion, Reuters reported. Whether the FAA’s review assigns the fault to installer error or to equipment, and whether lawmakers connect that request to Friday’s failure, are the next markers to watch.

Why air traffic data began contradicting itself at 3:36 p.m. on Friday is likely to be answered by a change log rather than a threat feed. If a routine changeover took down a critical system at your organization tomorrow, would your incident-response plan collect the change records promptly, and would your first public statement leave room for the answer to change?

News Sources

• FAA Statement on Nationwide Ground Stop (Federal Aviation Administration)
• ICYMI: U.S. Transportation Secretary Sean P. Duffy Announces Lifting of Nationwide Ground Stop, Provides Updates from FAA (U.S. Department of Transportation)
• ICYMI: U.S. Transportation Secretary Sean P. Duffy Provides Update on Restoration of Airspace Following Nationwide Ground Stop (U.S. Department of Transportation)
• L3Harris Statement on the Nov. 13 Ground Stop (L3Harris Technologies)
• ICYMI: Secretary Mullin and Secretary Duffy Address Nationwide FAA Ground Stop of All Flights (U.S. Department of Homeland Security)
• FAA General Statements (Federal Aviation Administration)
• FAA NOTAM Statement (Federal Aviation Administration)
• November 13 FAA Ground Stop Updates (Port of Seattle)
• Live Airline Flight Cancellations Info & Statistics (FlightAware, Nov. 13, 2026, statistics, accessed Nov. 15, 2026)
• No Signs of Hacking in FAA Ground Stop as FBI Reportedly Probes Software Update (SecurityWeek)
• FAA blames Friday’s ground stop on ‘equipment issue’ during telecoms network upgrade (NPR)
• FAA telecom problems that triggered the ground stop were so alarming the White House situation room and national security apparatus went into action (Fortune)
• FAA halts all US departures, warns airborne flights to expect holding nationwide (AeroTime)
• Trump official seeks $50 billion for air traffic control after outage (Reuters via Yahoo News)
• Duffy Asks Congress for $50 Billion After Nationwide Flight Halt (The Epoch Times)
• Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams (SecurityWeek)
• Microsoft Struggles to Restore Email and Other Services in a Global Outage (Associated Press via SecurityWeek)
• Microsoft says services fully restored after hours-long global outage (Associated Press via ABC7)

Assisted by GAI and LLM Technologies

Additional reading

• Notion AI chats surface in Fireworks breach, testing what zero retention covers
• France ties October supermarket fridge sabotage to Iran’s IRGC and seeks arrest warrants
• ENISA’s update advisory turns the patch pipeline into an evidence trail
• Britain’s cyber agency warns of a possible surge, and its own incident figures raise a question
• Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin
• Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker
• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.