Summary

  • A September 2026 GAO audit found that FAA had identified interference, spoofing and jamming risks to aviation communication links but had not completed risk and mitigation assessments or security documentation for selected systems.
  • FAA lacked a defined, real-time monitoring and detection capability for all spectrum-related threats. Funding constraints limited on-site tools for some high-risk systems; the agency could investigate reported incidents without consistently detecting them first.
  • GAO made nine recommendations, including continuous monitoring of National Airspace System communication links and a plan to strengthen authentication and protection of ACARS and CPDLC messages. DOT agreed on FAA's behalf. Implementation, coverage and detection time remain the tests.

A threat assessment does not hear the radio

The Government Accountability Office's aviation cybersecurity audit starts with a busy system. FAA provides air traffic services for more than 44,000 flights and 3 million passengers each day. Aircraft, controllers, airline operations centers and communications providers depend on radio-frequency links to exchange position, clearance, weather and operational messages. A disrupted signal can therefore interfere with decisions taken in flight and on the ground.

FAA has named the danger. Spectrum interference can obscure a signal; jamming can deny it; spoofing can make false information appear to come from a legitimate source. The agency had identified such threats to the National Airspace System and international routes. Yet GAO found incomplete risk and mitigation assessments and outdated or incomplete security documentation for selected systems. Its first recommendation calls for a formal risk assessment of seven of eight systems the auditors examined. That is a finding about a selected group, not a count of every FAA system.

The sharper problem is observation. GAO found no defined, real-time monitoring and detection capability for all spectrum-related threats. Officials cited funding constraints that limited the deployment of some monitoring tools at high-risk systems. Without those tools on site, FAA cannot proactively monitor for interference, spoofing or jamming there. Its public report page puts the consequence plainly: the agency can investigate an incident after it is reported. A report is useful. A live radio threat can travel faster than the route by which someone notices, diagnoses and reports it.

GAO measured selected systems and a defined gap in continuous capability. A current map of deployed sensors and covered links, paired with an exercise showing detection and response times, would establish whether FAA has closed it. A policy that says a team will investigate reports cannot supply that record.

A message can be the attack surface

The audit also examined two applications used for text-based aviation messages. ACARS supports exchanges involving aircraft, airlines and air traffic operations; CPDLC carries controller-pilot data-link messages that can include clearances and instructions. GAO found limitations in authentication, encryption and protocol design that leave these applications vulnerable to interception, spoofing and tampering. It used a fraudulent clearance-cancellation message as a risk scenario: a false text could delay flights or create safety risk.

This matters to monitoring because a message that looks syntactically normal can still be false. An alerting tool has to be joined to a decision process: who can question the message's origin, how is a suspect instruction cross-checked, and when does the controller or pilot receive a reliable warning? GAO recommended that FAA, with federal and non-federal partners, plan stronger authentication and data protection for ACARS and CPDLC. That is a separate engineering track from detecting radio interference, but both end at the same operational desk where a human must decide which signal to trust.

FAA is not working alone. GAO assessed eight leading practices for interagency collaboration and found that FAA fully met two and partially met six. It had defined responsibilities within groups, but lacked formal procedures for sharing and coordination with non-federal partners outside those groups. A monitoring network will generate disputed readings and cross-boundary incidents. The receiving party needs a route for evidence, not just a seat on an interagency panel. Still, the central question of this article is earlier: who sees the anomaly before the first report arrives?

Nine GAO recommendations cover risk assessments, monitoring, collaboration and message protection. The Department of Transportation concurred for FAA. Agreement is a starting decision. The evidence of a working system would be a dated deployment inventory for selected aviation links, clear thresholds for flagging suspicious signal behavior, a responsible operational recipient, and exercises that measure the interval from anomaly to action. No public audit figure in this report measures that end-to-end interval. Until one does, a completed meeting or risk register can be mistaken for detection.

The sky is not waiting for a governance diagram. A communications system earns trust when it can identify a suspect signal while there is still time to check the instruction it carries. FAA has documented what could go wrong. The next public evidence should show what the system can actually see.

Sources: US GAO report page; GAO original full report.