The agency that runs American air traffic cannot watch the radio spectrum it depends on in real time, and it has not finished formal risk assessments for most of the systems that use it.
The Government Accountability Office reviewed eight spectrum-dependent systems and found that the Federal Aviation Administration had completed formal risk assessments for only one. Watchdogs said the technology exists to monitor jamming, spoofing and other interference continuously, but the FAA has nothing comparable, so it can investigate incidents only after pilots or controllers report them.
Fake clearances in the data link
Investigators also found weaknesses in authentication and encryption in text-based aircraft communications, including ACARS and controller-pilot data link. The GAO said those gaps could let an attacker transmit fraudulent messages, among them cancellations of clearances an aircraft is already flying.
A crash in New Mexico
Fresh urgency sits behind the findings. Four people died on May 14 when a Beech C90 air ambulance went down near Lincoln, New Mexico, among them two flight nurses and both pilots. Three further aircraft in the area reported losing satellite navigation too, and the NTSB has noted jamming activity in the region at the time. No probable cause has been assigned.
The GAO issued nine recommendations, including continuous monitoring and stronger authentication. The FAA agreed to all of them.
