The U.S. Government Accountability Office has found that the Federal Aviation Administration has not fully assessed or mitigated cybersecurity risks to national airspace communications, leaving aircraft data links exposed to spoofing and jamming threats. The report, released on Monday, also says the FAA lacks a real-time detection capability for all spectrum-related threats and has not completed formal risk assessments for seven of eight spectrum-dependent systems reviewed.
The findings centre on communications used across the US national airspace system, including ACARS and controller-pilot data link communications, which support operational messaging between pilots, airlines and air traffic control. The GAO warned that weaknesses in authentication, encryption and security documentation could allow attackers to intercept, impersonate or send fraudulent messages, potentially triggering delays, airspace disruptions or safety issues.
The watchdog issued nine recommendations covering risk assessment, continuous monitoring, interagency coordination and communications security. The Department of Transportation, responding on FAA’s behalf, agreed with all nine. Senator Ron Wyden described the communications system as “incredibly insecure”, while the FAA said cyber and electromagnetic vulnerabilities pose increasing risks to critical aviation systems.