FAA Ground Stop 2026: How One Router Grounded Flights Across the US

At 3:36 p.m. Eastern on Friday, November 13, 2026, radar returns and radio links began behaving erratically at air traffic control centers and TRACONs across the country. Eighteen minutes later the Federal Aviation Administration did something it had done only once before since the morning of September 11, 2001: it halted departures nationwide. The ground stop ran from 3:54 p.m. to 8:15 p.m., four hours and twenty-one minutes in which controllers worked more than 3,500 airborne aircraft safely down to their destinations while almost nothing new left the ground. The White House convened an emergency meeting in the Situation Room while federal agencies worked to rule out a cyberattack.

The cause turned out to be ordinary. A contractor crew at a remote FAA site was cutting an end-of-life copper circuit over to fiber, and a router involved in that work began hitting the rest of the network with more than 1,000 connection attempts every four to five seconds. By Saturday night, FlightAware had counted more than 6,400 additional cancellations and 8,000 delays on top of Friday’s 9,100-plus cancellations. FAA Administrator Bryan Bedford asked travelers for patience until late Sunday.

This article reconstructs the failure from the official record. It explains why a few hundred connection attempts per second can overwhelm a national network, and it covers a detail that has received little attention: the same contractor lineage, on the same network, during the same kind of migration, caused a nearly identical crisis 17 years ago.

FAA ground stop at a glance

• Date and duration: Friday, November 13, 2026. The nationwide ground stop ran from 3:54 p.m. to 8:15 p.m. Eastern.
• Trigger: a router involved in a copper-to-fiber cutover at a remote FAA site, which press reports placed in southern Arkansas.
• Reach: communications problems at 17 of the FAA’s 22 en route centers.
• Hardware: senior government sources told CBS News the problem was isolated to Cisco 600-series routers manufactured between 2001 and 2006.
• Network owner: L3Harris owns the FAA Telecommunications Infrastructure (FTI).
• Ruled out: officials found no evidence of a cyberattack and no evidence of AI involvement.
• Fallout: more than 9,100 cancellations on Friday and more than 6,400 additional cancellations on Saturday.
• Money: Transportation Secretary Sean Duffy raised his funding request to $50 billion.

Inside the FAA Telecommunications Infrastructure: a contractor-owned backbone

The network at the center of this is the FAA Telecommunications Infrastructure, or FTI, and the government does not own it. “The network that we use at the FAA to control the airspace, L3Harris actually owns that network,” Duffy said on Saturday. The relationship goes back more than twenty years, to the original FTI award to Harris Corporation in 2002, before a 2019 merger created L3Harris.

L3Harris’s program page says FTI connects more than 4,400 facilities and manages more than 29,000 services supporting roughly 45,000 daily flights. En route centers, terminal radar approach controls, towers, remote radar sites, remote air-to-ground radio outlets, weather stations and flight-data systems all run over this one managed backbone. Bedford described its condition bluntly. He called FTI “one of the worst kept secrets in government” and said every agency that has examined it for two decades has flagged it as a critical weakness.

The 1980s copper and TDM layer underneath

Beneath the fiber sits a 1980s time-division multiplexing network, the circuit-switched world of fixed timeslots and dedicated copper pairs. Bedford, whose agency spends roughly $1 billion a year just to sustain it, described it as “call it 1G.”

The migration to fiber and IP transport is being forced by the carriers. Duffy said the copper line cut over on Friday was so old that the telephone company was discontinuing it, so the FAA had to move the circuit or lose it. Bedford put the conversion at about 70 percent complete, and he kept this sustainment work separate from the headline modernization program: “We are constantly replacing 2,000 Cisco 600 routers with Juniper routers. So, this is ordinary course-of-business stuff, this is not part of the Peraton-FAA $12.5 billion modernization effort.”

Cisco 600-series routers and the Arkansas cutover

Bedford’s remark also narrows down the hardware. Senior government sources told CBS News the problem was isolated to Cisco 600-series routers made between 2001 and 2006. These are early-2000s ADSL access routers that ran Cisco’s CBOS software instead of mainstream IOS, customer-premises-class equipment of the kind that terminates a copper access line at a small remote site.

The Professional Aviation Safety Specialists union, which represents FAA technical staff, said two routers were updated on Friday, believed to be in Arkansas and Texas. It said PASS-represented technicians were not involved and that the FAA had conducted a safety assessment before the work. Press reports placed the cutover site in southern Arkansas.

The work happened on a Friday afternoon because of a standing routine. Duffy explained that cutovers at big facilities are done at night, while small remote sites are handled during the day on the assumption that they cannot affect the wider system. “They shouldn’t have that kind of impact,” he said, and he promised to reevaluate the policy.

Why a few hundred connection attempts per second can take down a national network

Duffy’s figure, repeated across the weekend briefings, was “over 1,000 connection attempts every four to five seconds,” which CBS News described more precisely as log-on attempts. The arithmetic gives roughly 200 to 250 session initiations per second. To anyone who works on internet-scale systems, that sounds like a rounding error. It is nowhere near a volumetric flood: even with generous per-packet overhead, a few hundred session requests per second is a small fraction of a single megabit, trivial for any modern fiber link.

Bandwidth is simply the wrong resource to measure. Friday’s failure, as officials described it, matches a textbook control-plane overload, and control-plane capacity is counted in processor cycles and session state.

Data plane vs. control plane

Every router splits its work in two. The data plane forwards established traffic at wire speed in dedicated hardware. The control plane is a general-purpose processor that handles everything addressed to the router itself: routing adjacencies, management sessions, authentication, tunnel and session setup.

A transit packet costs almost nothing. A new connection attempt costs a punt to the CPU, a state-table allocation, often a cryptographic or authentication exchange, and a teardown when the attempt fails. When a device falls into a pathological retry loop and fires hundreds of parallel attempts without exponential backoff, every node that has to answer pays that per-session cost hundreds of times a second. On 2001-era access hardware, with a processor sized for a handful of management sessions and a thin, predictable stream of routing traffic, that load means exhaustion.

How one saturated router cascades into 17 en route centers

Once a route processor saturates, routing keepalives and hellos queue behind the storm. Neighbors declare healthy paths dead and routes flap. The real-time streams that share the box inherit the jitter and loss, including radar data distribution and the voice signaling that keys a remote transmitter when a controller presses push-to-talk.

Bedford described radio frequencies cutting in and out at random and controllers switching between primary and backup systems. The instability reached communications at 17 of the FAA’s 22 en route centers, the facilities that manage high-altitude cruise traffic. Duffy said the failure split along technology lines: “our switches, our routers actually got overloaded with data… our new IP switches did not go down. It’s the old hardware that went down.”

What officials still haven’t determined

Officials have not published a protocol-level root cause. It remains undetermined whether the offending router was defective, misconfigured or badly installed. Duffy said so explicitly, and Bedford promised a root-cause analysis later. The engineering lesson holds in all three cases. The flood did not need to saturate a fiber strand, only the session handling of legacy devices, and the network delivered every attempt, unpoliced, to the hardware least able to absorb it.

Rebecca Guy, the FAA’s acting chief technology officer, said the agency disabled the problem function on roughly 60 routers of the same type in use nationwide and was doing additional testing with L3Harris. That admission means whatever one device did on Friday, its siblings could do on any future maintenance day. L3Harris said it takes the ground stop seriously and is supporting the investigation. Its shares fell about 4 percent in after-hours trading on Friday.

Why the FAA ordered a nationwide ground stop

It helps to be precise about what failed, because that drives the response. “No facilities went dark. Nothing was fully lost,” Bedford said. The FAA ordered the stop because the trend line was unacceptable. He described watching the count of affected facilities climb from two to three, then ten, then seventeen, and said the agency grounded the country because “we couldn’t explain it quickly.”

A center that loses all communications with its aircraft is a scenario controllers train for, but one they cannot tolerate while dozens of new aircraft per hour keep entering the sector. So the FAA stopped feeding the system. Airborne flights continued to their destinations, some departures were released case by case, and once the suspect site was isolated, Duffy said, every system came back online.

The controllers’ union told a harsher version of the same story. NATCA president Nick Daniels said controllers lost communications with some aircraft during the event, quoting members as saying “we know we didn’t have communications with airplanes.” That claim concerns individual aircraft, so it sits alongside the FAA’s claim about facilities and does not contradict it.

Paper maintenance logs and the safety assessment gap

Tracing the problem took roughly 45 minutes, in part because maintenance on this network is logged on paper. Officials had to search physical records to work out which contractor was touching which site that afternoon. In 2026, the change calendar for the telecommunications backbone of the world’s busiest airspace is not a queryable database.

Asked whether the FAA had ever imagined a meltdown of this size, Guy answered, “We did not.” A safety assessment was done before the cutover and evidently did not model this failure mode. Assessing the success path of a change is a different job from assessing the pathological behavior of the equipment being introduced.

Officials ruled out a cyberattack and any involvement of the FAA’s new AI-assisted traffic-management tooling. Bedford’s phrasing was “zero evidence of anything nefarious and zero evidence of anything AI related.” After the stop lifted at 8:15 p.m., more than 8,000 flight operations resumed that night alone.

Why flight cancellations lasted longer than the ground stop

A ground stop pauses departures, but an airline network cannot be paused without consequences that outlast the pause. Aircraft ended Friday night at the wrong airports. Crews ended it out of position, out of legal duty time under the federal flight-and-rest rules, or both. Bedford said roughly 12,000 flights could not be completed on Friday, about 9,000 commercial and 3,000 general aviation.

Recovery is a constraint-satisfaction problem. Every aircraft has to be ferried or flown back into position, and every crew has to be legal for its assignment. Reserve crews are finite, hub connection banks either hold for late arrivals or strand passengers, and curfews at airports like John Wayne and Reagan National hard-stop the catch-up. Airlines deliberately cancel chunks of the next day’s schedule to create the slack they need to reset, so Saturday’s cancellations were that recovery mechanism at work.

The numbers: Friday, Saturday and Sunday

The reset ran behind its own forecast. Speaking Saturday morning, Bedford projected 4,000 to 5,000 cancellations out of roughly 41,000 scheduled flights. By 9:35 p.m. the count had passed 6,400, with more than 8,000 delays on top.

Friday’s cancellations were led by American at 1,239, Southwest at 1,167, Delta at 1,162 and United at 1,137. By the end of the day, more than 9,100 flights within, into or out of the United States had been scrubbed, and delays ultimately exceeded 24,500 as the evening backlog compounded.

On Saturday, Delta, United and American each canceled about a quarter of their flights, while JetBlue, concentrated in the congested Northeast, cut nearly 45 percent. By Saturday night, 875 Sunday flights had already been canceled. The carriers issued no-fee rebooking waivers, and Bedford reminded travelers that canceled flights carry refund rights. He apologized while standing by the ground-stop decision and said schedules should be back to normal by the close of business Sunday.

For an industry that runs at high load factors with thin crew margins, a four-hour national pause becomes a two-to-three-day hangover. That multiplier is what any future failure of this kind will cost.

The 2009 FTI outage: same network, same contractor lineage

If Friday were the first time, it would be a bad day. It is the second time on this network. On November 19, 2009, maintenance to replace and upgrade a routing device on FTI produced a bottleneck that blocked data transmissions for nearly four hours, from 5:10 to 8:59 a.m. Flight plans had to be entered into air traffic control systems by hand, more than 800 flights were delayed, and 129 FAA facilities were disrupted, according to the independent review panel the FAA Administrator commissioned and the Transportation Department’s inspector general.

The contractor was Harris Corporation, L3Harris’s predecessor. The work was part of the migration from the legacy ATM network to FTI’s new optical backbone, a transition then about 95 percent complete.

What went wrong in 2009

The panel’s chronology reads like a design review of what went wrong again in 2026. During an earlier cutover of the Salt Lake City router on October 21, 2009, a routing-table error had been introduced into the Los Angeles and Albuquerque routers, defining an incorrect route between Salt Lake City and Los Angeles. The error sat dormant for a month until the Los Angeles router was restarted on November 19 and activated it. The router then advertised the erroneous preferred route across the network, pulling traffic toward the Los Angeles to Salt Lake City path regardless of origin or destination. That exceeded the path’s capacity, dropped packets, and effectively blocked about 75 percent of the IP routes on the optical backbone.

Harris managed these transitions with manual procedures and checklists whose execution was not properly verified, and it did not use automated tools to validate router configurations against a master table. The monitoring was also blind. An alarm for any router above 60 percent utilization for ten minutes had been inadvertently programmed to ignore alerts from all routers, after technicians tried to suppress false positives from one chronically busy, low-capacity router at the Atlantic City technical center. Harris did not know the alarm function was effectively dead, so engineers spent the outage without it.

The inspector general added that FAA’s oversight of the contractor could have been more effective and that the risk of future outages remained as new services were added to the fiber network. Among the fixes documented in the panel report was the creation of routing-domain segments in the optical backbone, divided by operating airspace and intended “to isolate and limit the impact of future outages.”

How the 2009 and 2026 failures compare

The two incidents are not mechanically identical. In 2009, a latent routing-table error concentrated the network’s traffic onto a path that could not carry it. In 2026, a device at a cutover site flooded the network with session attempts that legacy hardware could not process. One was a traffic-engineering failure and the other a session-handling failure.

Structurally they match. Both were planned transport migrations, executed by the same contractor lineage on the same contractor-owned backbone, in which one site’s change propagated across facility boundaries to national scale. In both, diagnosis was slowed by operational tooling: disabled alarms then, paper change logs now. In 2009 the panel could write that air traffic separation was never affected. In 2026 the controllers’ union says some aircraft were briefly unreachable.

The segmentation and monitoring disciplines the 2010 report promised were supposed to make a failure of this scale impossible, and on Friday they did not hold. That finding is what the current investigation owes Congress, and it is more damning than any installer’s typo.

Redundancy is not isolation: what the FAA network was missing

The most consequential quote of the weekend came when Bedford was asked why backup systems did not save the day. The facilities have multiple backup channels, he explained, but they all ride one network: “We have one federal telephony infrastructure. We don’t have two, but one.”

L3Harris’s marketing describes a multi-carrier architecture with diverse local exchange carriers, built-in redundancy and 99.99971 percent network reliability, a figure that allows roughly ninety seconds of downtime per year. Both statements can be true, and the gap between them is where the engineering problem sits. Carrier diversity protects against a backhoe cutting a cable. It does nothing against a logically valid storm of session requests, which every diverse path will deliver to every reachable node at once. Physical redundancy answers the question “what if a link dies.” It does not answer “what if a device misbehaves,” and on a shared backbone the primary and backup channels degrade together, because the thing that failed is the thing they have in common. Availability metrics measured in nines count link uptime. They do not measure whether the network can contain a pathological participant.

Network engineering controls that contain a misbehaving site

Containing a misbehaving device is a solved problem in network engineering, which makes this a governance story more than a technology mystery. The standard discipline treats every remote access site as an untrusted failure domain whose worst behavior has to be bounded where it meets the backbone.

• Control-plane policing classifies everything destined for a router’s own processor and rate-limits each class in hardware, so a session storm dies at the ingress port instead of consuming the CPU that routing keepalives and voice signaling depend on.
• Per-site ingress policers enforce the fact that a remote radar site or radio outlet has a predictable traffic profile and no legitimate reason to start hundreds of sessions per second.
• Routing-domain boundaries, the segmentation the 2009 panel documented, keep one site’s bad routing information from becoming every site’s bad routing information.
• Automated telemetry with circuit-breaker behavior can sever a misbehaving cutover port in seconds and revert to the prior circuit, instead of leaving humans to correlate paper maintenance logs for 45 minutes while seventeen centers degrade.
• Pre-production fault injection tests how a device fails before it reaches the network. The offending function had to be disabled on about 60 production routers after the event, which suggests the exact firmware, configuration template and legacy-interaction behavior were never put through framing mismatches, failed authentications and retry storms in a mirrored lab.

Duffy called the copper-to-fiber work “not complicated… pretty straightforward,” and in its success path it is. Critical-infrastructure change management exists because straightforward changes have unstraightforward failure paths, and because the afternoon maintenance window at the site nobody worries about is where a national outage tends to start.

The $50 billion FAA modernization question

The funding response came fast and large. Duffy, who had been pressing Congress for $30 billion as recently as November 12, the day before the ground stop, raised his ask to $50 billion and prepared a formal request for the following Monday. That sits on top of the $12.5 billion Congress approved last year.

House Speaker Mike Johnson told Fox News he supports approving more money this year. Representatives Rick Larsen and Andre Carson, the Democrats slated to chair the House Transportation and Infrastructure Committee and its aviation subcommittee when their party takes the House in January, pointed out that of the $12.5 billion already appropriated, the department has awarded $4.3 billion in contracts but spent only $1 billion. They promised to hold the administration accountable.

Who builds and runs the FAA’s telecom networks

The contractor landscape those dollars flow through is itself in motion. L3Harris runs the legacy FTI as sustainment. Peraton leads the $12.5 billion modernization effort that Bedford took care not to conflate with Friday’s cutover. The successor telecom program, FAA Enterprise Network Services, has already changed course once: from Verizon’s $2.4 billion, fifteen-year award in March 2023 to a restructuring around AT&T in August 2026, under a sole-source arrangement that began with a $74.3 million task order. Verizon was retained in a supporting role, and the agency cited its 2028 modernization deadline.

Why the urgency is real

The GAO, reporting on the FAA’s own 2023 assessment of 138 air traffic control systems, found 51 of them, 37 percent, unsustainable and another 54 potentially unsustainable. The workforce is roughly 3,000 controllers short of staffing targets. In April and May 2025, controllers handling Newark approaches at the Philadelphia TRACON lost radar and radio contact for stretches of up to 90 seconds after telecom failures tied to aging copper wiring.

The only other nationwide ground stop since 9/11 came on January 11, 2023, when contract personnel unintentionally deleted files while synchronizing the NOTAM database with its backup. Departures halted for about 90 minutes and more than 11,000 flights were disrupted.

That makes three national events in four years, in three different systems, with one shared pattern: routine contractor work, an unbounded failure path, and a diagnosis slower than the cascade. Money is necessary to break the pattern, and the spend rate on funds already appropriated suggests execution capacity limits progress as much as appropriations do. Friday’s failure also did not happen for lack of a modern router. It happened during the installation of one, inside a program whose leader described the work as ordinary course of business. New fiber and new switches change the steady state, but they do not by themselves install the policing, segmentation, fault-injection testing, digital change records and automated rollback that decide what happens when the steady state ends.

What the FAA investigation has to answer

The proximate cause will eventually be labeled defective hardware, installer error or misconfiguration, and L3Harris’s exposure will be argued in hearings and possibly in court. The systemic questions are already visible and should not wait for the root-cause report:

• Why could a single remote site inject an unbounded session storm into a backbone serving seventeen en route centers?
• Why does every backup channel share the fate of the primary?
• Why does the change calendar of a safety-critical network live on paper?
• Why did a function dangerous enough to disable on sixty routers reach production untested?
• Why did the segmentation and monitoring remedies documented after 2009 fail to contain a failure their authors explicitly anticipated?

Bedford framed the stakes without spin: the old network, he said, “will continue to break until we replace it.” The corollary costs discipline more than dollars. The years of coexistence between the old network and its replacement are the danger zone, and every cutover in that window deserves one non-negotiable test before it touches production: if this device behaves as badly as it possibly can, the damage stops at this site. On November 13, 2026, the damage reached all fifty states, and preventing a repeat is the agenda for the $50 billion now being requested.

FAA ground stop FAQ

What caused the November 2026 FAA ground stop?

A contractor crew was cutting an end-of-life copper circuit over to fiber at a remote FAA site, and a router involved in the work began sending more than 1,000 connection attempts every four to five seconds. Officials have not yet said whether the router was defective, misconfigured or badly installed.

Was the FAA ground stop a cyberattack?

No. FAA Administrator Bryan Bedford said there was zero evidence of anything nefarious and zero evidence of anything AI related.

How long did the nationwide ground stop last?

Four hours and twenty-one minutes, from 3:54 p.m. to 8:15 p.m. Eastern on Friday, November 13, 2026.

Who owns the FAA’s telecommunications network?

L3Harris owns the FAA Telecommunications Infrastructure (FTI). Transportation Secretary Sean Duffy confirmed this publicly, and the contract traces back to a 2002 award to Harris Corporation.

Why were flights still canceled after the ground stop ended?

Aircraft and crews ended Friday night out of position, and many crews were out of legal duty time. Airlines canceled part of Saturday’s schedule to create the slack needed to reset, which pushed recovery into Sunday.