Terry Gerton You’ve got a recent report out that focuses again on aviation cybersecurity, but in this case, specifically on communications that depend on the electromagnetic spectrum. I just gotta say, there are really important recommendations here, but they are a little technical. So before we get into all of that, can you explain, I’m just gonna say in plain English, what we’re talking about here? What are the real threats that you were looking at?
Jennifer Franks Yeah, absolutely. And I love a technical review. So overall, our focus really was to look at whether the Federal Aviation Administration was identifying and mitigating spectrum-related cyber threats. So these are specific threats that would impact the aviation industry, how we are able to navigate and actually control our flights. We’re looking at their collaborative partners. FAA does not do this alone. They have several partners in the federal community that are integrated in helping them to look out for the controls that help to mitigate these types of threats. Addressing vulnerabilities in two key aircraft communication applications was our focus for this review. So we looked at ACARS and CPDLC and those two systems. The control was really looking to understand how they’re able to protect some of the cybersecurity vulnerabilities that could impact them, given a lot of these newer aircrafts have newer technologies that are supporting them.<![CDATA[]]>
Terry Gerton We tend to think of cybersecurity as protecting systems from intrusion, but your report spends a lot of time on spoofing. So are we increasingly dealing with a problem of trusting the information inside the system rather than just protecting the network itself?
Jennifer Franks Yes, that’s a good question. And to be honest, it is a new context of really looking at how we are elevating and enhancing our cybersecurity protection. So when you think about spoofing, it is really the act of falsifying identity features to impersonate a trusted source. But hacking really involves a technical skill to directly access, manipulate, or even try to exploit the system of the data. So if you’re thinking about this from the airplane’s perspective, then you have air traffic control that is constantly in communication with the flight. When considering how that information is transmitted across these different airwaves, spoofing then manipulates the metadata to make an untrusted data source look trusted. And this is different from hacking because hacking can really compromise the entire channel, the entire system. Spoofing is really targeted. It’s going for one goal.
Terry Gerton One of the interesting aspects of the report is that FAA itself had identified many of these threats, but you found a disconnect between recognizing the threat and fixing or managing it. Talk to us about what you found there.
Jennifer Franks Yeah, that’s a good question. And so FAA recognized the threats. Again, interference, spoofing, jamming. And we did review eight systems that are related to this communications in aviation. But what we found was some of the systems lacked very detailed and specific risk assessments. And why you need a risk assessment is because you’re looking at specific vulnerabilities that could impact how data is used or misused in your environment. They had an overall plan for the communications environment, but for each of the specific systems that we reviewed that navigated themselves up into the overall communication systems, we were looking at outdated standards, missing required controls, and inconsistent categorization of data, and this type of information not being updated, not being available to you. Could then impact how FAA is able to monitor real-time the capabilities for these types of threats, like the spectrum threats, the spoofing. But on the positive, rather, FAA did have some new technologies they’re rolling out constantly, trying to update the operational capacity and looking at really specific technological advancements and now starting to really highlight and consider some of these risk-based decisions and requirements.
Terry Gerton Jennifer Franks is acting chief technology officer at the Government Accountability Office. Jennifer, the report deals quite a bit with this kind of technology, with the real-time monitoring, with this spoofing, but it also talks about coordination, and you mentioned up front that FAA doesn’t do this alone. How are their coordination processes keeping up or keeping pace with the cybersecurity Challenge?
Jennifer Franks That’s a good question and you can’t do this alone. We shouldn’t do alone. We did find that FAA is or has established coordinating practices and collaboration efforts for these other entities that support them. But of the eight systems we’ve reviewed, only two of them had fully met the requirements that are required for leading collaboration practices. And then the other six really had some gaps in looking at who’s accountable, should something happen, who’s owning this and making the accountable decision? There was some information sharing inconsistencies. You know, when things are happening very fast and very regular, how are we sharing the data that is going to then impact the other parts of the industry that are your partners? Leadership continuity is something that we’re also seeing gaps in because as you know, with the federal government, there’ve been a lot of changes lately. And folks are also retiring and moving on to other positions and not having continuity in some of these very key roles was also impacting the collaboration efforts. And then with that, your stakeholder participation, oftentimes your stakeholders are waiting to be involved, but if there’s so many changes and continuity issues, that communication channel wasn’t necessarily open.
Terry Gerton Did your team come away with a sense that the aviation community really appreciates how significant these gaps are and how they may have operational impacts? Or was it just sort of, yeah, yeah, we got some things that we need to take care of?<![CDATA[]]>
Jennifer Franks It was a combination of both. I think we conducted this review from the request of the Congress through a mandate. And if you go out into the world wide web, there’s been efforts to reviewing both ACARS and CPDLC for some time. And they’ve been highlighting the general lack of encryption standards and authentication methods and what it would look like if these systems were compromised. But where FAA is, it’s pretty confident right now is it hasn’t happened. And they do have some very key safeguards in place to really offer those additional protections to those that travel and those that work in the airline industry, those that are working from the air traffic control down to navigating what’s on the ground and then in the sky. So yes, they identify, we have some weaknesses, we can all stand to upgrade and be better at collaborating, communicating, and documenting, and really securing additional controls. But right now, they definitely feel like they have a good handle on managing the situation.
Terry Gerton The latest aircraft are ever more high tech, they’re more networked, they’re more connected in lots and lots of ways. So how do your findings now impact how the FAA should be thinking about future technology, future controls, future cyber protection?
Jennifer Franks That’s a good question. So we assessed and then made nine recommendations to FAA. And thinking through the evolution of technology and what FAA should be considering, one of them, again, is the continuous monitor for the interference, spoofing, and the jamming. These are specific to this industry and specific for what it is we need for them to be focusing on so that they can better detect threats, should they occur, instead of primarily investigating after events have happened. Because we do not want it to be after the fact. And then, you know, one of our other recommendations really focused on developing and implementing a plan, a stronger plan to strengthen authentication and data protection for these types of communication systems. Specifically, we focused on ACARS and CPD DLC, but we want to help protect pilot controller communications against unauthorized messages, spoofing and potentially being tampered.
Terry Gerton As FAA is modernizing the air traffic control system, is this an opportunity to build cybersecurity in from the start? Or are some of the vulnerabilities that you’ve identified likely to persist even after these modernization efforts are complete?
Jennifer Franks That’s a great question, and it’s both, to be honest. I think not having a cybersecurity specialist, that expert at the table from the inception and the design, the start of your conversation, and then continually throughout the life cycle of what it is you’re working on, you put yourself at harm’s way and at risk for not being able to assess all of the necessary risks to your environment. So include the technologies, include the cybersecurity speeds that will help you to think through some of the blind spots so that you can focus on the system and the data and how it should be communicating for your environment
Terry Gerton Jennifer, you’re not only the author of this report, but you are yourself a member of the flying public. How confident are you when you get on a plane that the pilots have good information, that these systems are going to work as they need to work?
Jennifer Franks I’m real confident. I’ve had two FAA cybersecurity-related reviews that come out in the last two months, and I fly pretty regularly back and forth. I have great confidence that there are mitigating controls in place, that we are safe, that, yeah, every day you see cybersecurity vulnerabilities impacting something. When you think about the technologies that are on a plane, the same way you have technologies in the palm of your hand for your phones and your laptops or your smart devices at home. Everything is an automated service and everything is communicating to a system that can potentially be compromised. So we can’t go into anything thinking that things can’t happen, things can. But I do think, and then working with the agency and looking at some of the higher level controls, with our recommendations. Really soft in terms of really looking for some of the interconnected things that need to happen to make sure that we are on top of it. But FAA is doing what it is they need to do to make sure that you’re safe, whether we’re on the ground or in the air and the communications are not being compromised.Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
——————————————————-
Click Here For The Original Source.
