Some of the digital communications connecting U.S. aircraft and air traffic controllers still lack security protections now considered routine elsewhere in computing, according to a new federal audit examining threats including spoofing, jamming and message manipulation.
The U.S. Government Accountability Office, or GAO, released its aviation cybersecurity review on September 21 and concluded that the Federal Aviation Administration has not sufficiently addressed several electromagnetic-spectrum threats affecting the National Airspace System.
The problem matters at enormous scale: the FAA provides air-traffic services for more than 44,000 flights and three million passengers every day.
FAA cannot detect every spectrum attack in real time
GAO found that the FAA has identified threats including spoofing and jamming, but has not completed all of the risk assessments, mitigation work and updated security documentation required to address them.
Critically, the agency does not have real-time monitoring and detection capability for all spectrum-related threats. That means certain incidents can only be investigated after they have been reported rather than detected automatically as they occur.
Spoofing involves transmitting deceptive signals intended to make a system believe false information is legitimate, while jamming interferes with the radio-frequency signals systems depend on.
Reuters reported that the vulnerabilities could allow attackers to transmit fraudulent clearance cancellations or other messages to aircraft, potentially causing delays, airspace disruption or safety problems.
Some aircraft messaging predates modern cybersecurity
One reason is architectural age.
Reuters reported that two communication systems used for messages between aircraft and the ground were developed before modern cybersecurity safeguards became commonplace and lack commonly used encryption protections.
GAO specifically recommends improving authentication and data protection for Aircraft Communications Addressing and Reporting System (ACARS) and Controller Pilot Data Link Communications (CPDLC).
Its ninth recommendation calls on the FAA and industry partners to strengthen authentication and data protection for ACARS and CPDLC to reduce the risks of spoofing, unauthorized transmissions and message tampering.
Senator Ron Wyden described the underlying technology as incredibly insecure and vulnerable to interception, impersonation and jamming.
The FAA accepted all nine recommendations
GAO issued nine recommendations covering risk assessments, security documentation, threat monitoring, coordination and stronger communication protections.
The Department of Transportation, responding for the FAA, agreed with all nine recommendations. The FAA also said increasing connectivity between aircraft and flight operations creates growing cyber and electromagnetic risks to air traffic control, data communications and avionics.
The findings underline a problem familiar throughout critical infrastructure.
Systems designed decades ago often assumed that access to specialized equipment or communications networks provided meaningful protection. Modern attackers operate in an environment where software-defined radios, increasingly connected systems and readily available computing power weaken those assumptions.
For engineers, aviation therefore illustrates why cybersecurity modernization cannot simply be added around legacy infrastructure.
Authentication, encryption and real-time detection have to exist inside the communication architecture itself.
The difficult part is that aviation cannot replace those systems like a software company updates an application. Changes must work across aircraft, ground infrastructure, operators and regulators while maintaining continuous availability.
That makes the FAA findings more than an aviation story. They are another example of legacy technology becoming cybersecurity infrastructure before it was designed to be cybersecurity infrastructure at all.
