On a Friday afternoon, the nation's skies went quiet all at once when the Federal Aviation Administration ordered every aircraft to stay on the ground, a reminder of how much modern life rests on invisible networks of wire and signal. A single router, installed during an upgrade meant to replace old copper lines with fiber, reportedly flooded the system with connection attempts until the whole air traffic network faltered. Officials have ruled out malice for now, but the deeper question of how one malfunctioning device could stop a continent's flights remains open as Washington prepares to ask
Trump Was Briefed Within 30 Minutes of FAA Nationwide Ground Stop, Officials Say
A router firing 1,000 connection attempts every few seconds grounded a nation.
Four hours, thousands of flights. What actually broke?
Officials say a router at a remote facility started firing more than 1,000 connection attempts every four to five seconds while a contractor, L3Harris, was swapping copper lines for fiber. That flooded routers across the FAA network.
That's the officials' account, though, and Duffy called it apparent. The sequence is likely, not established.
Why did the government move so fast to rule out an attack?
Because a nationwide halt looks the same at first whether it's a cyberattack or a fault. Agencies from the FBI to Cyber Command were talking within minutes, and intelligence found no chatter or pings.
Note the wording: preliminarily ruled out. That's a first pass, not a final finding.
And the president's role?
Staff briefed him within 30 minutes while he was in an economic meeting, and relayed his directives. He then called congressional leaders about FAA funding.
The 30-minute figure comes from unnamed U.S. officials. We don't know what he was told or what he directed.
What should we watch?
Monday's Homeland Security Council meeting, and whether funding for air traffic control modernization moves.
And the open question: how one router's behavior could take down the entire network. Nobody has answered that yet.
Le Pouls
- At 3:36 p.m. Eastern, about 3,500 airborne flights were ordered to stay on the ground as the air traffic network seized up.
- Agencies from the FBI to Cyber Command scrambled into a single call while the President was pulled from an economic meeting to be briefed.
- A contractor's router reportedly flooded the FAA network with more than 1,000 connection attempts every few seconds during a fiber upgrade.
- Roughly 9,159 flights were canceled and thousands of travelers were stranded, though medical flights were cleared to proceed.
- The grounding was lifted within about four hours, and a Homeland Security Council meeting on Monday will weigh how to prevent a repeat and push for FAA modernization funding.
On a Friday afternoon, the nation's skies went quiet all at once when the Federal Aviation Administration ordered every aircraft to stay on the ground, a reminder of how much modern life rests on invisible networks of wire and signal. A single router, installed during an upgrade meant to replace old copper lines with fiber, reportedly flooded the system with connection attempts until the whole air traffic network faltered. Officials have ruled out malice for now, but the deeper question of how one malfunctioning device could stop a continent's flights remains open as Washington prepares to ask how such fragility can be prevented.
At 3:36 p.m. Eastern on Friday, the Federal Aviation Administration ordered every plane in the country to stay on the ground. About 3,500 flights were already in the air. Within half an hour, President Trump had been told, and agencies from the FBI to the Joint Chiefs of Staff were on a shared call within minutes, working to understand what had gone wrong.
The intelligence community searched its channels for signs of an attack and found nothing, so officials preliminarily set aside the possibility of malicious activity. Medical flights were allowed to continue to their destinations. By the fourth hour the problem had been identified and the grounding lifted, but the day left around 9,159 flights canceled and thousands of travelers stranded in airports across the country.
On Saturday, Transportation Secretary Sean Duffy described the likely source. A telecommunications contractor, L3Harris Technologies, was replacing aging copper lines with fiber at a remote facility when a router began sending more than 1,000 connection attempts every few seconds, overwhelming the network. Duffy and Homeland Security Secretary Markwayne Mullin arrived more than 30 minutes late to a Friday evening press conference, as officials judged that interrupting the recovery effort was the wiser choice.
The political response started the same day, with the President calling congressional leaders about funding the FAA and modernizing air traffic control. A Homeland Security Council meeting on Monday will consider next steps and how to prevent a recurrence. Officials have a likely sequence of events, but the central question remains: how could one router bring down the entire system?
At 3:36 p.m. Eastern on Friday, the Federal Aviation Administration ordered every plane in the country to stay on the ground. About 3,500 flights were already in the air when the order came down. Within 30 minutes, according to U.S. officials, President Trump had been told.
The agencies began contacting one another within minutes of the order. The list included the FBI, the director of national intelligence, the Department of Homeland Security, the Transportation Department, the Justice Department, the Defense Department, the Joint Chiefs of Staff, U.S. Cyber Command, the FAA and the Federal Emergency Management Agency. At 4:16 p.m., Transportation Secretary Sean Duffy issued a statement saying the stop was needed because of "a communication issue impacting all Air Route Traffic Control Centers," and that FAA technicians were investigating.
Soon after, the White House led a call with the agencies to work out what had happened, and a plan was set in motion. The intelligence community searched its channels for chatter or pings and found nothing, and it preliminarily ruled out nefarious activity. Senior staff briefed Mr. Trump while he was in an economic policy meeting, one U.S. official said, and relayed his directives to the others on the multi-team call. Later, he met with Duffy and Homeland Security Secretary Markwayne Mullin.
The stop did not apply to everything. Medical services flights were cleared to continue to their destinations. By the fourth hour, the problem in the system had been identified and the grounding was lifted. FlightAware counted around 9,159 canceled flights on Friday and 7,190 delayed, leaving thousands of travelers stranded across the country.
At a news conference Saturday, Duffy described what appears to have started it. FAA telecommunications contractor L3Harris Technologies was doing maintenance at a remote facility, replacing aging copper communications lines with fiber optic connections. During that work, a router began generating more than 1,000 connection attempts every four to five seconds, overwhelming routers across the whole FAA network.
The officials' account also covers a smaller matter of timing. Mullin and Duffy were more than 30 minutes late for a 7:45 p.m. press conference Friday. U.S. officials said they were close to getting the grounding lifted and did not want to interrupt that effort to hold the briefing.
The political response began the same day. Mr. Trump started calling congressional leaders Friday to work on getting the FAA more funding, and the White House congressional team called key members about modernizing air traffic control. The Homeland Security Council, the interagency body Bush established in 2001 that works through the National Security Council framework, invited key government members and some outside stakeholders to a Monday meeting. The agenda is next steps and how to prevent a recurrence while modernization continues.
Federal officials have identified a likely sequence of events, but key questions remain about the underlying cause of the systemwide failure. Why one router could bring down the whole network is the question Monday's meeting will have to face.
Citations marquantes
A communication issue impacting all Air Route Traffic Control Centers.— Transportation Secretary Sean Duffy, statement at 4:16 p.m. ET