Four Hours Without Departures: A Timeline of the Nationwide FAA Ground Stop and the Software Update Now Under Scrutiny
A communications failure at the FAA’s air route traffic control centers grounded departures at every U.S. airport for more than four hours on Friday. Officials say they see no sign of hacking, and attention has turned to a software update and aging network equipment. Here is how it unfolded.
For more than four hours on Friday, departing flights were held on the ground at every U.S. airport. The cause was a communications breakdown across the Federal Aviation Administration’s regional air traffic control centers. In the first hours, nobody could say whether it was an attack. Since then, officials have said they see no evidence of hacking, and investigators are reportedly looking at a software update. Here is the sequence of events as reported so far.
This timeline is assembled from SecurityWeek’s follow-up on the investigation and its initial report on the ground stop. Times are Eastern.
Friday, November 13
- Before the nationwide order: The FAA has already halted traffic in Chicago because of air traffic control communication problems.
- Friday afternoon: The FAA issues a ground stop for all U.S. airports, citing “extraordinary circumstances” for safety. Transportation Secretary Sean Duffy posts on X that the order follows a communication issue affecting all Air Route Traffic Control Centers and that FAA technicians are investigating. Departures are held on the ground until further notice. Inbound international flights are handled case by case.
- While the stop is in effect: Federal officials do not identify a trigger, and it is not clear whether a cyberattack is involved.
- 8:15 p.m.: The ground stop is lifted, more than four hours after it began. Thousands of flights have been disrupted, and officials warn that delays will continue for several days.
After the restart
- “No footprints”: Speaking to reporters at the White House, Homeland Security Secretary Markwayne Mullin says the failure does not appear to be a cyberattack and seems mechanical. “There’s no chatter, we haven’t seen any footprints,” he says, while adding that investigators are still looking and will not rule it out. He says the NSA, the Defense Department, CISA and other agencies are involved.
- The FBI’s view: Bloomberg, citing a person familiar with the matter, reports that the FBI does not believe a cyberattack or criminal activity caused the outage and is examining a software update as a possible cause.
- Legacy equipment: Duffy says switches and routers on the FAA network were flooded with data and began producing inconsistent information, at which point the agency shut the system down.
- Patches and new gear: Mullin says the FAA appeared to be applying patches and installing new equipment and technology, which “was overwhelming the older system.”
- The network update: CBS News, citing multiple sources, reports that the outage followed an update to the private communications network linking the air traffic control system, which rebooted and then crashed. CBS says the network is operated by L3Harris.
- Ruled out: Officials say the incident is unrelated to the Microsoft outage earlier in the week and that the FAA’s recently deployed AI systems played no role.
The last time this happened
The previous nationwide ground stop came in January 2023, when a contractor accidentally deleted files while working on the system that sends safety notices to pilots. No cyberattack was found then either.
What this means for your company
The investigation is still under way, and the official cause has not been confirmed. But the leading explanations, an update to a critical network and older equipment that could not cope with changes, are problems every business faces at a smaller scale. A firmware update to a core switch or firewall can take an office down just as surely as an attacker can. Practical steps:
- Schedule changes to core network gear, and to anything else everyone depends on, during low-impact windows, and have a written rollback plan before you start.
- Test updates on one device or one site before rolling them out everywhere.
- Know which of your switches, routers and firewalls are past their vendor’s support life, and budget to replace them before they become the weak link.
- Have a fallback for critical communications, such as a secondary internet connection or a way to keep phones and payment systems working if the main network fails.
- When an outage hits, check for an attack but do not assume one. Logs and change records help you tell the difference quickly.
If your business has not looked at its change-management process or aging network equipment lately, this is a good moment to do it. Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
