A routine fiber-optic upgrade by a contractor flooded FAA routers with more than 1,000 connection attempts every four to five seconds, disrupting radar feeds and forcing a nationwide ground stop that delayed and canceled thousands of flights on Friday, November 13.

The communications failure spread fast enough to activate the White House situation room and the entire national security apparatus. FAA Administrator Bryan Bedford confirmed the escalation at a press briefing on Saturday, adding that the FBI had personnel in facilities to investigate.

"I think we've all concluded that it's not a cyber issue," Bedford said.

Why did the national security apparatus mobilize?

Transportation Secretary Sean Duffy said the response reflected genuine fear of a foreign cyberattack. FBI Director Kash Patel, the director of national intelligence, and the Defense Department all joined a conference call on Friday because officials suspected state-sponsored hacking.

Those concerns proved unfounded. Duffy said investigators found no online chatter indicating a hacking attempt, and once the FAA isolated the location where the telecom problem originated and took it offline, the system returned to normal operation.

"We feel very comfortable that that was the root cause of the impact on our system," Duffy said. "It wasn't a foreign actor."

The alarm was contextual. October was dubbed "Black October" for its volume of cyberattacks. Hackers raised temperatures in freezers across Europe and at U.S. military bases, spoiling food. Cybersecurity experts rushed to patch vulnerabilities in PHP, a programming language running nearly 70% of all websites. After the U.S. launched its war on Iran, the regime threatened retaliation in cyberspace and vowed to cut undersea internet cables. Consumers, meanwhile, are still recovering from a Microsoft outage that knocked out email, collaboration and AI functions — though Microsoft said Friday it had no indication the ground stop was related to its global outage.

What actually caused the failure?

According to Duffy, the trigger was mundane. A contractor working for L3Harris was performing routine maintenance at a remote FAA location, switching telecommunications lines from legacy copper wire to fiber optics. The changeover overwhelmed routers across the air traffic control system with the connection-attempt flood, disrupting some radar feeds. The FAA ordered the ground stop to guarantee safety.

Investigators have not settled on the precise fault. "So what we're working to determine was whether we had incompetence, meaning was it user error or installator error from L3Harris, or did they install a faulty router," Duffy said. "We haven't determined what the fault was. Was it the router or were they not doing great work for us at L3Harris?"

L3Harris did not immediately respond to a request for comment.

Who owns the network — and who answers for it?

Duffy repeatedly stressed that L3Harris owns the legacy telecom network and serves as the prime contractor, and he warned the department will hold people accountable. The Department of Transportation is working with what he called "the greatest telecom companies in the world" — AT&T, Verizon, and Lumen — to build a replacement architecture.

"Many of our contractors, many of our partners, they take our money and they provide really poor service to us," he said. "And we have demanded more. We've demanded better because the American people deserve better. And we're getting better performance from everyone who's doing business with us now. We need L3Harris or whoever provided that router to us to do a better job."

The episode leaves the FAA with two open questions: whether the fault lay in the hardware or in the installation, and how a single maintenance job at one remote site could cascade into a national aviation shutdown. Until the department completes its review, the accountability question rests with L3Harris.