One Router, 22 Control Centers: The FAA Ground Stop Is a Lesson in Infrastructure Resilience
Editor's note: This analysis reflects information available as of 11:00 p.m. Eastern time on November 14, 2026. The Federal Aviation Administration (FAA) has not published a root cause analysis. Officials have described a trigger, not a final cause. We will update this post when the findings are released.
Bottom line up front: On Friday, November 13, the FAA stopped every departure in the United States for more than four hours. Officials say there is no evidence of a cyberattack and no evidence that artificial intelligence (AI) played a role. Their working account is more ordinary and more instructive: routine upgrade work at one remote site disrupted a national network. The lesson is not about hackers. It is about how far a small fault is allowed to travel.
At 3:54 p.m. Eastern time, the departure boards changed at every airport in the country. Aircraft already in the air kept flying. Nothing else was allowed to leave. A ground stop is the simplest tool in aviation safety. When controllers cannot fully trust their systems, they stop adding aircraft to the sky. The order was lifted at 8:15 p.m.
What Is Confirmed, and What Is Not
The facts below come from FAA and Department of Transportation statements and from major news outlets.
The FAA cited communication issues at its Air Route Traffic Control Centers, the regional facilities that manage high-altitude traffic. Al Jazeera reported that all 22 centers were affected.
It was the first nationwide ground stop since January 2023 and the longest halt in departures since September 11, 2001.
FlightAware counted about 7,000 cancellations by 9 p.m. Friday, according to NPR. FAA Administrator Bryan Bedford said about 12,000 flights could not be completed. ABC News put cancellations across Friday and Saturday above 14,000. Counts differ by source and by hour.
On Saturday, Transportation Secretary Sean Duffy said a contractor was moving telecommunication lines from copper to fiber at a remote FAA site. He said a router involved in that work "started flooding other routers" with connection attempts. That traffic disrupted radio contact with aircraft and radar feeds.
Duffy named the contractor as L3Harris Technologies. The company said it is supporting the investigation. It did not address his criticism.
Bedford said there was "zero evidence of anything nefarious" and no sign of an AI-related fault.
Three things remain unknown. Officials have not determined whether the fault was a contractor error, a wrong configuration, or a defective device. The FAA has not explained why one site could disturb the whole network. The final report has no release date.
Why the AI Question and the Cyber Question Came First
Two suspects appeared within the first hour. Neither is supported by the evidence.
The first was a cyberattack. Homeland Security Secretary Markwayne Mullin said on Friday that officials saw no evidence of one. Duffy and Bedford repeated that on Saturday. That is a statement about evidence to date. It is not a final finding, and readers should treat it that way.
The second was the FAA's new AI traffic-planning tool, known as SMART. The agency expanded it to all 22 centers on November 10, three days before the outage. Its developer, Air Space Intelligence, said the ground stop was "not based on or a result of the SMART system." Federal officials have since said the same. The timing made the question reasonable. It did not make the answer yes.
A third theory linked the event to the Microsoft 365 outage that began on November 12. Microsoft said it had no indication of a connection, and officials reported none. Two failures in one week are not a pattern. They are two separate tests of the same habit: assuming the foundation will hold.
"The question is not whether a part will fail. The question is how far the failure is allowed to travel."
The Real Finding: A Small Change With a National Reach
If the officials' account holds, three details matter more than the age of the equipment.
The change was treated as local. Duffy said work at small, remote sites is routinely done during the day because it is not expected to affect the wider system. On Friday, that expectation was wrong.
The fault spread. A single device was able to flood other routers. Well-designed networks contain a misbehaving part so that the damage stays in one place.
The records were slow. Bedford said maintenance is logged on paper, which delayed the effort to learn who was working where.
Consider what the same weaknesses look like elsewhere.
A police department upgrades a radio link at a rural tower at midday, and dispatch goes quiet across the county.
A hospital network replaces a switch at one clinic, and patient records slow down at every campus.
A bank lets a vendor patch one branch router, and card payments fail statewide.
A Short Resilience Checklist
Map the reach of every site. Ask which small location could disturb your whole network, and why.
Schedule changes by worst case. If the worst outcome is severe, do the work when demand is lowest.
Know who is working where, in real time. A paper log is too slow during an emergency.
Practice the safe stop. Decide who can halt operations, and rehearse how to restart them.
Review your dependence on single vendors. Know who owns the network you rely on and what your options are.
An Analyst's View
The popular reading is that old technology failed. That reading is incomplete, and it deserves a challenge.
First, the system failed safely. Controllers moved aircraft to working frequencies, departures stopped, and no aircraft was lost. A four-hour halt is costly. It is also what a safety system is supposed to do when it cannot explain its own behavior.
Second, the outage occurred during modernization, not because of neglect alone. The copper-to-fiber program is more than 70 percent complete, according to L3Harris. The riskiest period in the life of any critical system is the transition, when old and new equipment must work together. Faster modernization without stronger change control can add risk before it removes it.
Third, the "aging equipment" message arrived alongside a request to Congress for a further $30.1 billion. The need may be real. Nevertheless, money buys equipment. It does not buy discipline. Decision-makers should ask for both.
"Modernization is not a destination. It is the most dangerous stretch of the road."
Early explanations also change. Friday's account was overloaded routers. Saturday's account was a single router during upgrade work. The final report may differ again.
What Comes Next, and How OSRS Can Help
The FAA expects airline schedules to recover by the close of business on Sunday. The investigation will take longer. Leaders do not need to wait for it. The questions it raises apply to any organization that runs on a network: how far can one fault spread, when do we make changes, and who is in charge when we stop.
OGUN Security Research and Strategic Consulting LLC serves an international audience that includes the intelligence community, law enforcement, academia, diplomats, and business leaders, and we present analysis to decision-makers in the United States and abroad. We can help your organization:
Assess single points of failure in networks and vendor relationships
Review change management and maintenance procedures
Test continuity and safe-shutdown plans through tabletop exercises
Deliver intelligence briefings on critical infrastructure risk for executives and boards
Contact us at contact@ogunsecurity.com.
Share this article with a colleague who manages critical systems, and subscribe to our email list to receive the follow-up when the FAA publishes its findings.
Enjoyed this article? Stay informed by following us on Google News, Twitter, and LinkedIn for more exclusive cybersecurity insights and expert analyses.
About the Author
Dr. Sunday Oludare Ogunlana, Founder and CEO of OGUN Security Research and Strategic Consulting LLC, Professor of Cybersecurity, national security scholar, and television commentator.
Intelligence. Protection. Strategy. www.ogunsecurity.com
Comments