The FAA needs stronger protections against aviation cybersecurity threats including spoofing and jamming, according to a new GAO report released Monday. The Government Accountability Office found incomplete risk assessments for several spectrum-dependent systems and said the FAA lacks a defined real-time capability to detect all spectrum-related threats.
Real-Time Monitoring Gap
“While FAA has identified spectrum-related threats, it hasn’t sufficiently addressed them,” the GAO said in the report.
The agency noted that technology exists to monitor such threats in real time, but the FAA does not currently have comparable capabilities.
“Consequently, FAA can only investigate incidents after they’ve been reported.”
The GAO reviewed eight spectrum-dependent systems and found the FAA had not completed formal risk assessments for seven of them. Investigators also identified vulnerabilities involving authentication and encryption in text-based aircraft communications. According to the report, those weaknesses could allow fraudulent messages, including clearance cancellations, to be transmitted.
New Mexico Accident
The report follows a May 14 accident in New Mexico in which a Beech C90 air ambulance crashed near Lincoln, killing both pilots and two flight nurses. An NTSB report said U.S. military GPS jamming was underway in the area during the flight. The crew reported losing GPS capability and requested headings from ATC, while three other aircraft also reported GPS losses. An Albuquerque Center controller asked that the military stop the jamming before the aircraft was cleared for a visual approach. The NTSB investigation remains underway and has not determined a probable cause.
Nine Recommendations
The GAO issued nine recommendations covering spectrum cybersecurity risks and aviation communications security. The recommendations include continuously monitoring interference, spoofing and jamming and strengthening authentication and data protection for ACARS and controller-pilot data link communications. The Department of Transportation, responding on behalf of the FAA, agreed with all nine recommendations.
Was a TFR issued and coordinated between the military and FAA to ensure private, commercial and drone operations are aware or is this a clandestine military operation not subject to informing non military operations for secrecy? Information appears missing from this article.