GAO Warns FAA Air Traffic Systems Can Be Intercepted or Impersonated

In 2025, jamming struck a Spanish military jet carrying Spain's defense minister. A GAO report released September 21, 2026 finds communications between U.S. air traffic controllers and commercial aircraft can be intercepted, impersonated or jammed. The FAA has not completed required risk assessments and updated security documentation for spoofing and jamming threats and lacks real-time detection capability for all spectrum-related threats. Two aircraft messaging systems were developed before modern cybersecurity safeguards and lack common encryption. The report said hackers could transmit fraudulent clearance cancellations or other messages to airplanes, potentially causing flight delays, airspace disruptions or safety issues. Senator Ron Wyden said the technology is incredibly insecure and that the FAA's failure to require secure communications is a major threat to national security, the economy and the safety of the flying public. The FAA agreed with all nine of the GAO's recommendations and acknowledged growing cyber and electromagnetic risks to air traffic control, data communications and avionics. Spoofing and jamming have disrupted critical satellite navigation in Europe. CONTESTED: Estonia and Finland have blamed Russia for jamming GPS navigation devices in regional airspace; Moscow has denied the charges.