FAA Ground Stop Traced to Router Flood: 1,000 Attempts Every Four Seconds

A nationwide ground stop lasting several hours on Friday, November 13, 2026, delayed and canceled thousands of flights — and the trigger was a telecom failure that flooded air-traffic-control routers with more than 1,000 connection attempts every four to five seconds.

The speed of the spread alarmed Washington. Officials said there was no evidence of a cyberattack or other nefarious activity, but the incident briefly reached the highest echelons of government.

During a Saturday press briefing, FAA Administrator Bryan Bedford said the White House situation room and the entire national security infrastructure were activated, and that the FBI was in facilities investigating. "I think we've all concluded that it's not a cyber issue," he declared.

Transportation Secretary Sean Duffy said FBI Director Kash Patel, the director of national intelligence, and the Defense Department joined a conference call because they feared a cyberattack from another country. They saw no online chatter indicating a hacking attempt. Once the FAA isolated the location where the telecom problem originated and took it offline, the system began functioning properly again.

"We feel very comfortable that that was the root cause of the impact on our system," Duffy said. "It wasn't a foreign actor."

Why were officials so jumpy?

Cybersecurity has been top of mind. Hackers raised temperatures in freezers across Europe and at U.S. military bases, making food spoil. Last month saw so many cyberattacks that observers dubbed it "Black October." Experts also rushed to fix vulnerabilities in the PHP programming language, which runs nearly 70% of all websites.

After the U.S. launched its war on Iran, the regime warned it would retaliate in cyberspace and threatened to cut undersea internet cables. Consumers, meanwhile, still grapple with a Microsoft outage that shut down email, collaboration and AI functions; the company said Friday it had no indication the ground stop was related to that global outage.

What actually broke?

The cause was mundane. A contractor with L3Harris was doing routine maintenance at a remote FAA location, switching telecom lines from old copper wire to fiber optics, according to Duffy. The changeover flooded routers across the air-traffic-control system with the connection attempts, disrupting some radar feeds. The FAA ordered the ground stop to ensure safety.

"So what we're working to determine was whether we had incompetence, meaning was it user error or installer error from L3Harris, or did they install a faulty router," Duffy said. "We haven't determined what the fault was. Was it the router or were they not doing great work for us at L3Harris?"

Duffy noted that L3Harris owns the legacy telecom network and serves as prime contractor, while the department works with what he called "the greatest telecom companies in the world" — AT&T, Verizon and Lumen — to build a new architecture.

He warned the department will hold people accountable.

"Many of our contractors, many of our partners, they take our money and they provide really poor service to us," he said. "And we have demanded more. We've demanded better because the American people deserve better. And we're getting better performance from everyone who's doing business with us now. We need L3Harris or whoever provided that router to us to do a better job."

L3Harris did not immediately respond to a request for comment. The takeaway in plain words: a routine copper-to-fiber swap grounded a nation, and the bill for contractor accountability may still come due.