FAA ground stop ends after five hours: old copper lines, not hackers, blamed

The Federal Aviation Administration lifted its nationwide ground stop on departing US flights at approximately 8:15 p.m. ET on Nov. 13, ending a five-hour halt that began shortly before 4 p.m. ET. More than 4,700 flights were canceled or delayed.

Transportation Secretary Sean Duffy said instability in radar and communications at air traffic control centers began just after 3:30 p.m. ET, when more than 3,500 planes were in the air. He blamed the outage on an "incredibly old air traffic control system" with "old switches, old routers" and "1980s little copper lines." Routers, he said, were overloaded with data.

Homeland Security Secretary Markwayne Mullin said the Trump administration has "seen zero evidence that this was a cyber attack." That statement matters: a nationwide aviation shutdown invites immediate speculation about a state or criminal actor, and the administration moved to close that line before it hardened.

The ground stop was the longest nationwide stop since the September 11, 2001 attacks. A January 2023 ground stop lasted about 90 minutes.

Duffy used the moment to renew a funding demand, calling for $50 billion to overhaul air traffic control systems. He said President Trump had asked for $30 billion in the past and framed the request as unfinished work: "new hardware, new software, new telecommunication." The administration argued Congress had "kicked the can down the road" on improvements that could have prevented the outage. The $50 billion is a request, not an approved appropriation.

Officials warned that unwinding the backlog would be slow. What exactly failed inside the telecom infrastructure, how old the specific routers and switches are, and whether any prior warning flagged the vulnerability have not been disclosed. The practical effect for security teams is a reminder that availability failures in critical infrastructure do not require an adversary: legacy hardware, overloaded routing, and copper-era links can produce the same operational halt as an intrusion, and they are often cheaper to fix than to investigate.