GAO Report Finds FAA Lacks Full Cybersecurity Measures for Air Traffic Communications

A Government Accountability Office audit released Monday found that the Federal Aviation Administration has not finished required risk assessments or updated security documentation to address spoofing and jamming threats to communications between air traffic controllers and commercial aircraft. The report also noted the agency lacks a real-time detection capability for spectrum-related threats.

Senator Ron Wyden said the findings show the technology used for controller-to-aircraft communications can be intercepted, impersonated and jammed, creating potential risks to flight operations and passenger safety. He added that the FAA’s current approach to securing these communications poses a threat to national security, the economy and the flying public.

The FAA did not immediately respond to requests for comment. It said it agrees with the GAO’s nine recommendations and highlighted that increasing interconnectivity of aircraft systems raises cyber and electromagnetic vulnerabilities for critical operations such as air traffic control and data communications.

The audit cited two legacy messaging systems that were developed before modern cybersecurity safeguards became standard and lack encryption. Similar spoofing and jamming incidents have been reported in Europe, where Estonia and Finland have accused Russia of disrupting GPS navigation devices in regional airspace, a claim Moscow denies.