The U.S. Government Accountability Office has warned that Federal Aviation Administration aircraft communications remain vulnerable to spoofing, jamming and fraudulent message injection, including fake clearance cancellations. The findings cover ACARS and CPDLC systems used by aircraft and air traffic controllers, and the FAA has accepted all nine recommendations in the report.
The watchdog said malicious actors could intercept or impersonate messages sent to aircraft, creating a risk of flight delays, airspace disruption and safety incidents. It also found the FAA has not completed some risk assessments or updated security documentation for spectrum-related threats, while lacking real-time detection for all such risks.
The report focuses on communications used across U.S. and international routes, making the issue relevant to airlines, avionics suppliers and air traffic infrastructure operators. The Department of Transportation, responding for the FAA, agreed to strengthen risk management, continuous monitoring, information sharing and message protection across the affected systems.