Pushing to prod on Friday the 13th: 13,000 flights canceled, $5.8 billion wiped out

A router flood on the FAA's network stopped every US departure for 4 hours 23 minutes: 13,000 flights canceled and $5.8 billion off the stocks.

Kevin Pham20 min read
SignalsRadioNetworkingData analysis

At 3:36 PM Eastern on Friday, November 13, the routers on the FAA’s private network started choking. Two minutes later, airplanes stopped taking off across the country. At 3:53 the FAA made it official: every departure in the United States was on hold, and it stayed that way for 4 hours and 23 minutes. The FAA’s explanation was “a temporary telecommunications outage.” It’s the third nationwide ground stop ever, after 9/11 and the 2023 NOTAM failure.

I spent the evening working out what it cost and what broke, using public data. Here’s what it looked like from the air, every plane over the country, 25 minutes to the second:

All observed aircraft, continental US, adsb.lol and contributors (ODbL 1.0). The stock counter measures change from each company's last quote before the stop (Nasdaq).

The bill

Wiped off airline stocks$3.7 billion from Thursday’s close to Friday’s last after-hours trades. United −3.6%, Delta −2.8%, American −2.8%, Southwest −1.9%, Alaska −2.7%, JetBlue −4.2%
Wiped off L3Harris$2 billion (−4.0% from Thursday’s close), all of it after hours, most within minutes of the company getting named. More on that below
People’s timeAbout $1.35 billion, and up to $3.9 billion. Math below
Cancellations13,259 by Saturday afternoon, per FlightAware: 9,159 Friday and 4,100 Saturday. The FAA expects 4,000 to 5,000 of Saturday’s roughly 41,000 flights to be cancelled, and “full schedule integrity” by the end of Sunday
Delayed7,190 Friday and about 3,200 Saturday
Departures that should have happenedAbout 7,400 in that window on a normal Friday (ADS-B, November 6)
Stranded1.3 to 2 million people on the cancelled flights alone, plus 27,000 on Air Canada and 18,002 in Mexico

Airlines dropped the minute the stop went out. L3Harris didn’t move until someone said its name:

Airlines fell minutes after the stop; L3Harris waited until it was named
Nasdaq quote API, last trade per 5 minutes. Dollar figures are Nasdaq market cap times the change at each stock’s last print.

Nine small charts of percent change from the previous close, 9:30 AM to 8 PM ET on Nov 13. Five of the six airlines drop within five minutes of the 3:53 PM stop, and all six slide further after hours to end 1.9% to 4.2% down. L3Harris stays near flat until it is named at 6:15 PM, then ends 3.8% down. Northrop and the S&P 500 ETF end within 1%.

View source values
Change is against each previous close. Implied value change is Nasdaq’s published market cap times the last-print change; ETFs have none. Lines end at each symbol’s last print in the capture.
SymbolCompanyPrevious close ($)Change at 4:00 PMLast print (ET)Last price ($)Change at last printMarket cap ($B)Implied change ($B)
LHXL3Harris271.84+0.19%7:18 PM261.5−3.80%50.73-1.93
NOCNorthrop Grumman549.13+0.24%7:17 PM548.43−0.13%——
SPYS&P 500 ETF757.12−0.50%7:19 PM750.1−0.93%——
UALUnited111.25−1.66%7:19 PM107.71−3.18%35.51-1.13
DALDelta86.55−0.08%7:19 PM84.35−2.54%56.71-1.44
AALAmerican13.31−1.09%7:20 PM13.05−1.95%8.73-0.17
LUVSouthwest45.23−0.64%7:59 PM44.37−1.90%22-0.42
ALKAlaska39.05−1.46%7:57 PM38−2.69%4.34-0.12
JBLUJetBlue3.81−1.31%7:59 PM3.6501−4.20%1.42-0.06
Six airlinesUAL, DAL, AAL, LUV, ALK, JBLU——————-3.34
Airlines and LHXSeven stocks——————-5.27
Change is against each previous close. Implied value change is Nasdaq’s published market cap times the last-print change; ETFs have none. Lines end at each symbol’s last print in the capture.
SymbolCompanyPrevious close ($)Change at 4:00 PMLast print (ET)Last price ($)Change at last printMarket cap ($B)Implied change ($B)
LHXL3Harris271.84+0.19%7:18 PM261.5−3.80%50.73-1.93
NOCNorthrop Grumman549.13+0.24%7:17 PM548.43−0.13%——
SPYS&P 500 ETF757.12−0.50%7:19 PM750.1−0.93%——
UALUnited111.25−1.66%7:19 PM107.71−3.18%35.51-1.13
DALDelta86.55−0.08%7:19 PM84.35−2.54%56.71-1.44
AALAmerican13.31−1.09%7:20 PM13.05−1.95%8.73-0.17
LUVSouthwest45.23−0.64%7:59 PM44.37−1.90%22-0.42
ALKAlaska39.05−1.46%7:57 PM38−2.69%4.34-0.12
JBLUJetBlue3.81−1.31%7:59 PM3.6501−4.20%1.42-0.06
Six airlinesUAL, DAL, AAL, LUV, ALK, JBLU——————-3.34
Airlines and LHXSeven stocks——————-5.27

Nobody publishes the cost of people’s time, so here it is, using DOT’s official value of an hour of an air traveler’s time (in 2025 dollars) and A4A’s cost of a plane sitting at the gate:

LowBaseHigh
Passengers per flight100125150
Value of a passenger-hour$53$64$79
1,841 held flights that still flew, waiting 2 / 3 / 4 hours$20M$44M$87M
Planes sitting at gates$10M$30M$59M
13,259 cancelled flights, rebooked 8 / 12 / 24 hours later$562M$1.27B$3.77B
Total$592M$1.35B$3.92B

That’s about $5.1 million for every minute of the stop, and it doesn’t count hotels, missed connections, refunds, cargo or anything outside the US.

$1.35B

Base-case cost of people’s time

Range $592M to $3.92B, in 2025 dollars.

Hours before the outage, the White House and DOT asked Congress for another $30.1 billion for aviation infrastructure, including $10.1 billion for air traffic control. That evening, Duffy called it an “emergency” and raised the ask to $50 billion for a complete overhaul, on top of the $12.5 billion Congress approved in July 2025. His pitch: “You will have more of them unless the American people and the Congress tell us to build.”

It didn’t stop at the border

WhereWhat happened
CanadaAir Canada cancelled all remaining Canada–US flights Friday. Montreal suspended all US flights. Toronto, Calgary and Vancouver held US-bound flights. NAV CANADA ground-stopped Toronto and Montreal
EuropeAt the FAA’s request, EUROCONTROL suspended every US-bound departure from its member states, 5 PM to midnight ET, from the UK to Israel. Dublin Airport warned of delays the next morning
Latin AmericaMexico told US-bound flights to stay on the ground. São Paulo-Guarulhos got an FAA alert to hold its US departures
PacificFlights to Hawaii and Alaska and some West Coast departures over the ocean were cleared to keep going
InboundFlightradar24 counted about 3,100 aircraft in the air bound for the US during the stop
On the groundAmtrak’s booking site fell over as people looked for another way home

What broke

The FAA Telecommunications Infrastructure (FTI) is the private network that ties FAA facilities together. “L3Harris actually owns that network,” Duffy said Saturday. Here’s how the story has moved:

WhoWhat
CBS News, Fri, multiple sources“an update to the private communications network that connects America’s air traffic control system” triggered a reboot, and it crashed on reboot. Names L3Harris as the operator
Wall Street Journal (via X), Fri“a telecommunications network overseen by L3Harris Technologies, according to people briefed on the matter”
CNN, FriThe FAA told airlines it was “a network router problem, believed to have started at Chicago Midway Airport”
Sec. Duffy, Fri night“So, we have TDM telecom. So, this is analog telecom. Our switches, our routers actually got overloaded with data.” They “started to give us inconsistency in the data from those routers, and because of that we shut the system down”
Sec. Mullin, Fri nightNew security patches on the older system appeared to overwhelm its routers
FAA preliminary findings, via CBSLimited to “Cisco 600 series routers that were manufactured between 2001 and 2006.” They “started feeding out-of-sync data packets,” which “causes static over voice communication lines and can cause screens to flash or go to black”
Sec. Duffy, Sat briefingAn L3Harris contractor at “a very remote location” was moving lines “from old copper wire” to fiber. A router in that switch “started flooding other routers,” with “over 1,000 connection attempts every four to five seconds.” Per NPR, the routers there date to 2001. Still open: “was it user error, installator error from L3Harris, or did they install a faulty router?”
FAA Administrator Bedford, Sat briefing“What we had were random reports from different facilities of certain frequencies that were going in and out.” Then “when we saw it go to two, three, ten, 17 facilities, that’s when we started to realize there was something much larger going on here.” It took “about 45 minutes to trace the problem.” “No facilities went dark. Nothing was fully lost.” Also: “zero evidence of anything nefarious and zero evidence of anything AI related”
Rebecca Guy, FAA acting CTO, Sat briefingThe FAA disabled the problem function on the roughly 60 routers of the same type and is testing further with L3Harris
Bedford, on the network“We have one federal telephony infrastructure,” “there’s no backup to the backup,” and “Let’s not kid ourselves; it will continue to break until we replace it”. And on FTI itself: “Every agency within the government for better than two decades has flagged this FTI system as a critical weakness”
Controllers, via IBTimesA Washington Examiner reporter said none of the 60 controllers she reached buy it. Equipment changes happen overnight or in quiet periods, not on a busy Friday afternoon

The network still runs on 1960s phone tech

TDM is how phone companies have moved calls since the 1960s. A T1 line carries 24 fixed slots of 64 kbit/s plus 8 kbit/s of framing, 1.544 Mbps in all, one call or slow data link per slot, all clocked in lockstep. That’s digital, so “analog” isn’t quite right, though an FAA paper from 2015 says radio, navigation and weather links still “use analog modems” at the edges. The phone companies are retiring it, and the FAA hasn’t finished moving off:

SourceWhat it says
FAA white paper, 2015“more than 90% of the 23,000+ services obtained under the FTI contract are TDM-based and support critical NAS services such as surveillance radar, air/ground voice, and interphone”
Industry white paper with Harris as co-author, 2017“Even the IP services delivered today with Ethernet interfaces are transported over a private TDM infrastructure”
NAS Safety Review Team, Nov 2023, p.26“FTI is based on time-division multiplex (TDM) technology that is no longer supported by the telephone companies’ lines on which the signals are actually carried”
DOT modernization plan, May 2025, p.3FTI is “heavily dependent on obsolete 1960s TDM technology across over 30,000 services at 4,600 sites”
L3Harris, Nov 270% of sites upgraded to fiber

New fiber doesn’t mean the TDM is gone. Where the equipment on each end still speaks TDM, a conversion box packs each circuit into IP packets and unpacks it at the other end. The FAA’s 2015 paper spells out what happens when those packets go wrong:

Without the inherent synchronous capability of TDM-based services, NAS applications may experience out-of-sync clocks leading to buffer overflows, lost frames, and variable latency – disrupting these critical NAS applications.

And for radios:

A single discard of a packet transporting 20 milliseconds of audio will result in the radio being unavailable to air traffic controllers for 2-4 seconds as the link is reestablished.

As for the “Cisco 600 series”: Cisco’s actual 600 series was DSL modem-routers, and FTI runs on dedicated circuits, not DSL. No public document names the router model inside FTI. A Cisco line of that age with T1 voice and data cards is the 2600, sold from 1998 to about 2007, and my guess is that’s what CBS meant.

A Cisco 2600 series router, the dark teal box labeled "Cisco 2600" on its right edge, sandwiched between a Cisco 2500 on top and a Nokia IP330 firewall underneath, with patch cables plugged into the firewall.

A Cisco 2600, middle. Photo by Jemimus, CC BY 2.0, cropped.

If it is a 2600, Cisco’s own numbers show how little it would take. One 40 to 80 MHz processor does everything, and Cisco rated it at 1,500 to 2,000 packets a second for traffic it has to handle itself instead of just forwarding. Several hundred connection attempts a second, a few packets each, is most of that. Cisco’s high-CPU guide lists what happens next: the router “does not send routing updates to other routers,” so its neighbors route around it, and the extra work lands on routers just as old. On the T1 side, Cisco lists “Static noise heard during phone calls” as a symptom of clocking trouble. Cisco stopped supporting the 2600XM in March 2012.

L3Harris has shown up here before. Its Trenchant division reportedly built part of the iPhone exploit kit in my post on Coruna.

The market figured out the L3Harris angle faster than the press did. LHX closed the day up 0.19%, seven minutes after the national stop, and sat flat after hours. A WSJ line naming L3Harris hit X at 6:14 PM. By 6:24 it was down 3.6%, and it bottomed at −6.2% at 6:42. Northrop and General Dynamics barely moved.

L3Harris shrugged off the ground stop, then fell when it was named
Nasdaq quote API, one last-trade print per minute, built into 5-minute candles. After-hours trading is thin.

L3Harris stock in five-minute candles from 9:30 AM to 7:18 PM ET on Nov 13. It stays within about 1% of the $271.84 previous close through the 3:53 PM ground stop and the 4:00 PM close. After a 6:14 PM X post quotes the WSJ naming L3Harris, it falls to $255.00 (−6.2%) at 6:42 PM and last trades at $261.50 (−3.8%).

View source values
Five-minute candles built from Nasdaq’s one-per-minute last-trade prints, Nov 13, 2026, ET. Change is the close against the $271.84 previous close. Buckets with no trade are left out.
Bucket (ET)OpenHighLowCloseClose vs. previous close
9:30 AM272.98272.98272.27272.27+0.16%
9:35 AM271.73271.73270.83270.83−0.37%
9:40 AM270.3270.3270.23270.23−0.59%
9:45 AM270.37270.68270.25270.48−0.50%
9:50 AM270.37270.73270.37270.73−0.41%
9:55 AM270.37270.37270.27270.27−0.58%
10:00 AM270.19270.96269.64270.96−0.32%
10:05 AM270.86270.86270.8270.8−0.38%
10:10 AM270.2270.5269.69269.69−0.79%
10:15 AM269.69269.69269.18269.18−0.98%
10:20 AM269.36269.9269.36269.63−0.81%
10:25 AM269.94269.97269.94269.97−0.69%
10:30 AM269.96271.03269.96270.5−0.49%
10:35 AM270.1270.5270.1270.38−0.54%
10:40 AM269.93269.93269.52269.64−0.81%
10:45 AM269.93269.93269.75269.75−0.77%
10:50 AM269.47269.47269.1269.1−1.01%
10:55 AM269.07269.07268.89268.89−1.08%
11:00 AM268.64268.96268.64268.96−1.06%
11:05 AM268.97269.21268.97269.14−0.99%
11:10 AM269.29269.43269.29269.43−0.89%
11:15 AM269.54269.74269.42269.72−0.78%
11:20 AM269.62269.74269.47269.5−0.86%
11:25 AM269.52269.7269.2269.7−0.79%
11:30 AM269.69269.82269.69269.82−0.74%
11:35 AM269.44269.63269.44269.57−0.84%
11:40 AM269.41269.59269.39269.59−0.83%
11:45 AM269.2269.38269.2269.38−0.90%
11:50 AM269.21269.3269.21269.22−0.96%
11:55 AM269.14269.14269.01269.01−1.04%
12:00 PM269.02269.19268.89269.11−1.00%
12:05 PM269.33270.03269.33270.03−0.67%
12:10 PM269.81269.81269.79269.79−0.76%
12:15 PM269.77269.77269.48269.48−0.87%
12:20 PM269.44269.69269.44269.6−0.82%
12:25 PM269.26269.26269.26269.26−0.95%
12:30 PM269.43269.43269.43269.43−0.89%
12:35 PM269.43269.72269.43269.72−0.78%
12:40 PM269.72269.74269.72269.74−0.77%
12:45 PM269.52269.52269.28269.44−0.88%
12:50 PM269.43269.61269.43269.44−0.88%
12:55 PM269.44269.44269.26269.26−0.95%
1:00 PM269.28269.38269.28269.38−0.91%
1:05 PM269.38269.43269.23269.23−0.96%
1:10 PM269.38269.38269.15269.15−0.99%
1:15 PM269.14269.14268.95268.95−1.06%
1:20 PM269.3269.3269.05269.05−1.03%
1:25 PM269.09269.34269.09269.19−0.97%
1:30 PM269.2269.24269.13269.15−0.99%
1:35 PM269.26269.26269.04269.04−1.03%
1:40 PM268.99269.05268.99269.05−1.03%
1:45 PM269.06269.08269.05269.08−1.01%
1:50 PM269.21269.21269.05269.12−1.00%
1:55 PM269.12269.13268.94268.94−1.07%
2:00 PM268.91268.99268.91268.94−1.07%
2:05 PM269.18269.18269.06269.16−0.99%
2:10 PM269.25269.46269.25269.46−0.88%
2:15 PM269.56269.56269.37269.52−0.85%
2:20 PM269.65269.66269.5269.66−0.80%
2:25 PM269.6269.6269.49269.49−0.87%
2:30 PM269.62269.69269.62269.64−0.81%
2:35 PM270.04270.05270.04270.05−0.66%
2:40 PM270.19270.33270.08270.08−0.65%
2:45 PM270.35270.51270.33270.41−0.53%
2:50 PM270.44270.44270.22270.27−0.58%
2:55 PM270.09270.35270.09270.31−0.56%
3:00 PM270.33270.63270.33270.58−0.46%
3:05 PM270.56270.63270.56270.56−0.47%
3:10 PM270.57270.68270.47270.49−0.50%
3:15 PM270.45270.45270.31270.33−0.56%
3:20 PM270.31270.49270.31270.49−0.50%
3:25 PM270.45270.49270.37270.49−0.50%
3:30 PM270.63270.81270.57270.81−0.38%
3:35 PM271.02271.02270.91270.91−0.34%
3:40 PM270.79270.88270.79270.83−0.37%
3:45 PM270.47270.8270.45270.8−0.38%
3:50 PM270.9271.12270.7270.7−0.42%
3:55 PM271.58272.45271.58272.38+0.20%
4:00 PM272.35272.8272.35272.35+0.19%
4:05 PM272.56272.56272.35272.56+0.26%
4:10 PM272.56273272.56273+0.43%
4:15 PM272.35272.97272.35272.97+0.42%
4:20 PM272.97272.97272.43272.55+0.26%
4:25 PM272.55272.55272.48272.55+0.26%
4:40 PM272.5272.5272.5272.5+0.24%
4:50 PM272272.35272272+0.06%
4:55 PM272.36274272.36274+0.79%
5:00 PM274274274274+0.79%
5:05 PM272273272272+0.06%
5:15 PM272272272272+0.06%
5:20 PM272.95273272.44273+0.43%
5:25 PM272.95272.95272.95272.95+0.41%
5:30 PM272.43272.43272.43272.43+0.22%
5:35 PM272.49272.69272.49272.69+0.31%
5:40 PM272.5272.5272.49272.49+0.24%
5:45 PM273273272.49272.49+0.24%
5:50 PM272.49272.95272.49272.57+0.27%
5:55 PM272.95272.95272.5272.5+0.24%
6:00 PM272.5272.5272.5272.5+0.24%
6:05 PM272.22273.69272272+0.06%
6:10 PM272.31272.31272.01272.05+0.08%
6:15 PM272.43272.43270.5270.5−0.49%
6:20 PM269.64269.64262.02262.02−3.61%
6:25 PM262.85267.66261.5267.66−1.54%
6:30 PM264265.32263.21263.21−3.17%
6:35 PM261.7265260.77260.77−4.07%
6:40 PM258.03258.3255256.12−5.78%
6:45 PM257259256.62259−4.72%
6:50 PM258259.94257.2259.94−4.38%
6:55 PM259.9259.9257.62257.62−5.23%
7:00 PM259.89261.45259259−4.72%
7:05 PM261.38261.5259259−4.72%
7:10 PM258.56260.8258.56260.69−4.10%
7:15 PM260261.5260261.5−3.80%
Five-minute candles built from Nasdaq’s one-per-minute last-trade prints, Nov 13, 2026, ET. Change is the close against the $271.84 previous close. Buckets with no trade are left out.
Bucket (ET)OpenHighLowCloseClose vs. previous close
9:30 AM272.98272.98272.27272.27+0.16%
9:35 AM271.73271.73270.83270.83−0.37%
9:40 AM270.3270.3270.23270.23−0.59%
9:45 AM270.37270.68270.25270.48−0.50%
9:50 AM270.37270.73270.37270.73−0.41%
9:55 AM270.37270.37270.27270.27−0.58%
10:00 AM270.19270.96269.64270.96−0.32%
10:05 AM270.86270.86270.8270.8−0.38%
10:10 AM270.2270.5269.69269.69−0.79%
10:15 AM269.69269.69269.18269.18−0.98%
10:20 AM269.36269.9269.36269.63−0.81%
10:25 AM269.94269.97269.94269.97−0.69%
10:30 AM269.96271.03269.96270.5−0.49%
10:35 AM270.1270.5270.1270.38−0.54%
10:40 AM269.93269.93269.52269.64−0.81%
10:45 AM269.93269.93269.75269.75−0.77%
10:50 AM269.47269.47269.1269.1−1.01%
10:55 AM269.07269.07268.89268.89−1.08%
11:00 AM268.64268.96268.64268.96−1.06%
11:05 AM268.97269.21268.97269.14−0.99%
11:10 AM269.29269.43269.29269.43−0.89%
11:15 AM269.54269.74269.42269.72−0.78%
11:20 AM269.62269.74269.47269.5−0.86%
11:25 AM269.52269.7269.2269.7−0.79%
11:30 AM269.69269.82269.69269.82−0.74%
11:35 AM269.44269.63269.44269.57−0.84%
11:40 AM269.41269.59269.39269.59−0.83%
11:45 AM269.2269.38269.2269.38−0.90%
11:50 AM269.21269.3269.21269.22−0.96%
11:55 AM269.14269.14269.01269.01−1.04%
12:00 PM269.02269.19268.89269.11−1.00%
12:05 PM269.33270.03269.33270.03−0.67%
12:10 PM269.81269.81269.79269.79−0.76%
12:15 PM269.77269.77269.48269.48−0.87%
12:20 PM269.44269.69269.44269.6−0.82%
12:25 PM269.26269.26269.26269.26−0.95%
12:30 PM269.43269.43269.43269.43−0.89%
12:35 PM269.43269.72269.43269.72−0.78%
12:40 PM269.72269.74269.72269.74−0.77%
12:45 PM269.52269.52269.28269.44−0.88%
12:50 PM269.43269.61269.43269.44−0.88%
12:55 PM269.44269.44269.26269.26−0.95%
1:00 PM269.28269.38269.28269.38−0.91%
1:05 PM269.38269.43269.23269.23−0.96%
1:10 PM269.38269.38269.15269.15−0.99%
1:15 PM269.14269.14268.95268.95−1.06%
1:20 PM269.3269.3269.05269.05−1.03%
1:25 PM269.09269.34269.09269.19−0.97%
1:30 PM269.2269.24269.13269.15−0.99%
1:35 PM269.26269.26269.04269.04−1.03%
1:40 PM268.99269.05268.99269.05−1.03%
1:45 PM269.06269.08269.05269.08−1.01%
1:50 PM269.21269.21269.05269.12−1.00%
1:55 PM269.12269.13268.94268.94−1.07%
2:00 PM268.91268.99268.91268.94−1.07%
2:05 PM269.18269.18269.06269.16−0.99%
2:10 PM269.25269.46269.25269.46−0.88%
2:15 PM269.56269.56269.37269.52−0.85%
2:20 PM269.65269.66269.5269.66−0.80%
2:25 PM269.6269.6269.49269.49−0.87%
2:30 PM269.62269.69269.62269.64−0.81%
2:35 PM270.04270.05270.04270.05−0.66%
2:40 PM270.19270.33270.08270.08−0.65%
2:45 PM270.35270.51270.33270.41−0.53%
2:50 PM270.44270.44270.22270.27−0.58%
2:55 PM270.09270.35270.09270.31−0.56%
3:00 PM270.33270.63270.33270.58−0.46%
3:05 PM270.56270.63270.56270.56−0.47%
3:10 PM270.57270.68270.47270.49−0.50%
3:15 PM270.45270.45270.31270.33−0.56%
3:20 PM270.31270.49270.31270.49−0.50%
3:25 PM270.45270.49270.37270.49−0.50%
3:30 PM270.63270.81270.57270.81−0.38%
3:35 PM271.02271.02270.91270.91−0.34%
3:40 PM270.79270.88270.79270.83−0.37%
3:45 PM270.47270.8270.45270.8−0.38%
3:50 PM270.9271.12270.7270.7−0.42%
3:55 PM271.58272.45271.58272.38+0.20%
4:00 PM272.35272.8272.35272.35+0.19%
4:05 PM272.56272.56272.35272.56+0.26%
4:10 PM272.56273272.56273+0.43%
4:15 PM272.35272.97272.35272.97+0.42%
4:20 PM272.97272.97272.43272.55+0.26%
4:25 PM272.55272.55272.48272.55+0.26%
4:40 PM272.5272.5272.5272.5+0.24%
4:50 PM272272.35272272+0.06%
4:55 PM272.36274272.36274+0.79%
5:00 PM274274274274+0.79%
5:05 PM272273272272+0.06%
5:15 PM272272272272+0.06%
5:20 PM272.95273272.44273+0.43%
5:25 PM272.95272.95272.95272.95+0.41%
5:30 PM272.43272.43272.43272.43+0.22%
5:35 PM272.49272.69272.49272.69+0.31%
5:40 PM272.5272.5272.49272.49+0.24%
5:45 PM273273272.49272.49+0.24%
5:50 PM272.49272.95272.49272.57+0.27%
5:55 PM272.95272.95272.5272.5+0.24%
6:00 PM272.5272.5272.5272.5+0.24%
6:05 PM272.22273.69272272+0.06%
6:10 PM272.31272.31272.01272.05+0.08%
6:15 PM272.43272.43270.5270.5−0.49%
6:20 PM269.64269.64262.02262.02−3.61%
6:25 PM262.85267.66261.5267.66−1.54%
6:30 PM264265.32263.21263.21−3.17%
6:35 PM261.7265260.77260.77−4.07%
6:40 PM258.03258.3255256.12−5.78%
6:45 PM257259256.62259−4.72%
6:50 PM258259.94257.2259.94−4.38%
6:55 PM259.9259.9257.62257.62−5.23%
7:00 PM259.89261.45259259−4.72%
7:05 PM261.38261.5259259−4.72%
7:10 PM258.56260.8258.56260.69−4.10%
7:15 PM260261.5260261.5−3.80%

What the open data shows

How it started, minute by minute

The first sign is in Boston. NOAA’s public radar archive shows the FAA’s Boston weather radar feed going dark at 2:29 PM, and an NWS note at 3:44 PM says why:

TBOS data restored. Boston Center reported teleco issues actively being worked. There could be further interuptions until all is resolved.

After that, the full day of ADS-B from adsb.lol shows when each airport’s last plane took off:

Time (ET)What happened
2:29 PMBoston weather radar feed drops. NWS later blames Boston Center telecom
3:16 PMLast departure from O’Hare (Chicago Center)
3:18 PMLast departure from Sacramento (Oakland Center)
3:22 PMLast departure from St. Louis (Kansas City Center)
3:23 PMLast departure from Houston Intercontinental (Houston Center)
3:28 PMO’Hare’s ground stop shows up in the FAA advisories, 12 minutes after its last departure
3:36 PMWhen Duffy says the instability began
3:38 PMDepartures stop at almost every other big airport at once
3:53 PMThe national ground stop advisory goes out

Chicago, Sacramento, St. Louis and Houston are four Centers on opposite sides of the country, and they went down within seven minutes of each other. That’s Bedford’s Saturday account in data: “random reports from different facilities” that grew to “two, three, ten, 17 facilities” before anyone could explain it.

Then the whole country stopped in about two minutes, against two normal Fridays:

Departures stopped at 3:38 PM, 15 minutes before the ground stop
ADS-B from adsb.lol (ODbL). A takeoff is a ground-to-air switch within 6 km of the airport.

Takeoffs at 49 big US airports on Friday Nov 13 against Fridays Oct 30 and Nov 6, in Eastern time. Per hour, Nov 13 matches the other Fridays until 3 PM, then drops below 75 an hour. Per 2 minutes, it runs near 40 until 3:34 PM, then falls to 28 at 3:36, 8 at 3:38 and 1 at 3:40, while the other Fridays stay near 40. The advisory came at 3:53.

View source values
ADS-B takeoffs at 49 hubs. Hour rows cover midnight to 7 PM ET; 2-minute rows cover 2 PM to 5 PM ET. Each Friday is on its own Eastern clock (EDT on Oct 30, EST after Nov 1).
Bin (ET)Fri Nov 13Fri Nov 6Fri Oct 30
12 AM hour419389395
1 AM hour284215238
2 AM hour217201203
3 AM hour147145125
4 AM hour916776
5 AM hour136143120
6 AM hour463448470
7 AM hour646617670
8 AM hour982850969
9 AM hour107810471063
10 AM hour126712721191
11 AM hour117911591159
12 PM hour118111011069
1 PM hour112610931070
2 PM hour109211091056
3 PM hour70511641156
4 PM hour4912331159
5 PM hour5911731079
6 PM hour7111161070
2:00 PM443632
2:02 PM334140
2:04 PM373535
2:06 PM344444
2:08 PM344037
2:10 PM373829
2:12 PM423343
2:14 PM373543
2:16 PM343937
2:18 PM364438
2:20 PM443540
2:22 PM423831
2:24 PM394536
2:26 PM353639
2:28 PM394242
2:30 PM373432
2:32 PM413832
2:34 PM364232
2:36 PM333735
2:38 PM324531
2:40 PM363032
2:42 PM343039
2:44 PM284235
2:46 PM373331
2:48 PM392530
2:50 PM362634
2:52 PM373437
2:54 PM343425
2:56 PM323733
2:58 PM334132
3:00 PM353741
3:02 PM322633
3:04 PM343637
3:06 PM463734
3:08 PM333931
3:10 PM394340
3:12 PM354030
3:14 PM334627
3:16 PM424433
3:18 PM403938
3:20 PM303441
3:22 PM383432
3:24 PM303532
3:26 PM273552
3:28 PM303363
3:30 PM423647
3:32 PM414138
3:34 PM405141
3:36 PM283237
3:38 PM84231
3:40 PM13838
3:42 PM44143
3:44 PM23938
3:46 PM53854
3:48 PM34244
3:50 PM24142
3:52 PM24938
3:54 PM03131
3:56 PM04437
3:58 PM34133
4:00 PM13848
4:02 PM14141
4:04 PM23735
4:06 PM14243
4:08 PM03538
4:10 PM05142
4:12 PM24643
4:14 PM04140
4:16 PM04147
4:18 PM15434
4:20 PM04338
4:22 PM03636
4:24 PM15039
4:26 PM13934
4:28 PM14042
4:30 PM13444
4:32 PM23242
4:34 PM23732
4:36 PM23832
4:38 PM43836
4:40 PM24834
4:42 PM04435
4:44 PM24735
4:46 PM33648
4:48 PM23133
4:50 PM34838
4:52 PM05247
4:54 PM33440
4:56 PM24032
4:58 PM104031
ADS-B takeoffs at 49 hubs. Hour rows cover midnight to 7 PM ET; 2-minute rows cover 2 PM to 5 PM ET. Each Friday is on its own Eastern clock (EDT on Oct 30, EST after Nov 1).
Bin (ET)Fri Nov 13Fri Nov 6Fri Oct 30
12 AM hour419389395
1 AM hour284215238
2 AM hour217201203
3 AM hour147145125
4 AM hour916776
5 AM hour136143120
6 AM hour463448470
7 AM hour646617670
8 AM hour982850969
9 AM hour107810471063
10 AM hour126712721191
11 AM hour117911591159
12 PM hour118111011069
1 PM hour112610931070
2 PM hour109211091056
3 PM hour70511641156
4 PM hour4912331159
5 PM hour5911731079
6 PM hour7111161070
2:00 PM443632
2:02 PM334140
2:04 PM373535
2:06 PM344444
2:08 PM344037
2:10 PM373829
2:12 PM423343
2:14 PM373543
2:16 PM343937
2:18 PM364438
2:20 PM443540
2:22 PM423831
2:24 PM394536
2:26 PM353639
2:28 PM394242
2:30 PM373432
2:32 PM413832
2:34 PM364232
2:36 PM333735
2:38 PM324531
2:40 PM363032
2:42 PM343039
2:44 PM284235
2:46 PM373331
2:48 PM392530
2:50 PM362634
2:52 PM373437
2:54 PM343425
2:56 PM323733
2:58 PM334132
3:00 PM353741
3:02 PM322633
3:04 PM343637
3:06 PM463734
3:08 PM333931
3:10 PM394340
3:12 PM354030
3:14 PM334627
3:16 PM424433
3:18 PM403938
3:20 PM303441
3:22 PM383432
3:24 PM303532
3:26 PM273552
3:28 PM303363
3:30 PM423647
3:32 PM414138
3:34 PM405141
3:36 PM283237
3:38 PM84231
3:40 PM13838
3:42 PM44143
3:44 PM23938
3:46 PM53854
3:48 PM34244
3:50 PM24142
3:52 PM24938
3:54 PM03131
3:56 PM04437
3:58 PM34133
4:00 PM13848
4:02 PM14141
4:04 PM23735
4:06 PM14243
4:08 PM03538
4:10 PM05142
4:12 PM24643
4:14 PM04140
4:16 PM04147
4:18 PM15434
4:20 PM04338
4:22 PM03636
4:24 PM15039
4:26 PM13934
4:28 PM14042
4:30 PM13444
4:32 PM23242
4:34 PM23732
4:36 PM23832
4:38 PM43836
4:40 PM24834
4:42 PM04435
4:44 PM24735
4:46 PM33648
4:48 PM23133
4:50 PM34838
4:52 PM05247
4:54 PM33440
4:56 PM24032
4:58 PM104031

The airplanes stopped 15 minutes before the paperwork did.

Here’s the paperwork:

FAA Command Center advisory 111, National Ground Stop, signed 20:54 UTC on Nov 13, 2026: "Due to extraordinary circumstances and for reasons of safety. Attention all aircraft operators, by order of the Federal Aviation Command Center all airports are ground stopped. All departing traffic should remain ground stopped until further notice. Inbound international flights will be managed on a case by case basis."

Seattle Center’s radios kept working

Orcas Airband, a public receiver in the San Juan Islands, logged pilots reading back Seattle Center clearances through the afternoon. A readback means the pilot heard the controller. What changed was the traffic: Seattle Center ran at about a quarter of Thursday’s count during the stop, and approach went silent from 7:15 to 9:00 PM.

Seattle Center kept talking through the ground stop, just less
Orcas Airband public transcripts. Counts are what the receiver transcribed, not every transmission.

Radio transmissions per 15 minutes from 3 to 11 PM ET, heard by the Orcas Airband receiver, Friday Nov 13 against Thursday Nov 12. Seattle Center drops after the 3:53 PM stop and runs at 28% of Thursday’s count until the 8:16 PM cancel, with two silent quarter-hours. Seattle and Whidbey Approach logs nothing from 7:15 to 9:00 PM. Grey bins are capture gaps.

View source values
Transcribed transmissions per 15 minutes, duplicates and broadcasts dropped. “No capture” marks bins the receiver feed did not cover; it is not zero traffic. Bins start at the listed Eastern time.
Bin (ET)Center, Fri Nov 13Center, Thu Nov 12Approach, Fri Nov 13Approach, Thu Nov 12
3:00 PM1463618
3:15 PM3521916
3:30 PM31133724
3:45 PM33151719
4:00 PM11273326
4:15 PM17401328
4:30 PM15381220
4:45 PM13222019
5:00 PM744332
5:15 PM1628920
5:30 PM832021
5:45 PM8202623
6:00 PM034843
6:15 PM3241347
6:30 PM313421
6:45 PM09310
7:00 PM412333
7:15 PM718036
7:30 PM525018
7:45 PM123018
8:00 PM110028
8:15 PM434018
8:30 PM225028
8:45 PM1714010
9:00 PM218524
9:15 PM613813
9:30 PM9161425
9:45 PMno capture7no capture13
10:00 PM1017024
10:15 PM916316
10:30 PM1925136
10:45 PMno capture31no capture7
Transcribed transmissions per 15 minutes, duplicates and broadcasts dropped. “No capture” marks bins the receiver feed did not cover; it is not zero traffic. Bins start at the listed Eastern time.
Bin (ET)Center, Fri Nov 13Center, Thu Nov 12Approach, Fri Nov 13Approach, Thu Nov 12
3:00 PM1463618
3:15 PM3521916
3:30 PM31133724
3:45 PM33151719
4:00 PM11273326
4:15 PM17401328
4:30 PM15381220
4:45 PM13222019
5:00 PM744332
5:15 PM1628920
5:30 PM832021
5:45 PM8202623
6:00 PM034843
6:15 PM3241347
6:30 PM313421
6:45 PM09310
7:00 PM412333
7:15 PM718036
7:30 PM525018
7:45 PM123018
8:00 PM110028
8:15 PM434018
8:30 PM225028
8:45 PM1714010
9:00 PM218524
9:15 PM613813
9:30 PM9161425
9:45 PMno capture7no capture13
10:00 PM1017024
10:15 PM916316
10:30 PM1925136
10:45 PMno capture31no capture7

So not every center lost its radios. One controller told Scripps “no one seems to have actually lost theirs.” The outage was real and patchy.

It wasn’t jamming, the weather radars, or the internet

Before blaming the network, I ruled out the other suspects. A HackRF in Los Angeles listened across the aviation band and the GPS frequency for anyone transmitting over them. NOAA’s radar archive and space-weather scales covered the NWS scare and the sun. Public routing data and the FAA’s own DNS showed whether its internet side went down, and ADS-B squawk codes showed whether pilots lost their radios.

SuspectCheckResult
JammingA HackRF on the airband and GPS frequenciesNothing there. Normal traffic
Space weatherNOAA scalesR0, S0, G0
NWS “radar outage”NEXRAD on AWS197 to 200 radars on time all afternoon. A website problem
Internet routingRIPEstat BGPNo FAA routes withdrawn. L3Harris announces nothing publicly
Pilots losing radiosADS-B squawk 7600 (lost comms)Two civil aircraft over the US during the outage. 12 lost-comms squawks worldwide all day, against 9 on a normal Friday

It’s happened before

On November 19, 2009, one router misconfiguration on the same network, then run by Harris, took down 129 FAA facilities and blocked about 75% of its routes for five hours. Per the DOT Inspector General’s report CC-2010-012, recovery was slow because an alarm filter meant for one router silenced alarms from every router.

The report’s own summary:

The configuration error essentially went unnoticed and ultimately created a “domino effect” across the FTI network when all circuits on the new fiber optic network failed, resulting in 820 flight delays.

Back then the FAA didn’t even own the network. The OIG called the Harris contract “essentially a 15-year lease,” and described the FAA’s view into it like this:

Although FAA has three representatives on-site at the Harris facility to monitor FTI outages and managers at the two FAA Network Enterprise Management Centers, they have limited ability to oversee FTI.

In 2009 the radios survived because they weren’t on the network that failed. The OIG called those circuits critical “because they transport FAA’s critical voice and radar data information.” They’re being retired: GAO-26-107992 says the plan is to “replace 5,170 copper lines with fiber optic cable and transition nearly 30,000 services to Internet Protocol.” L3Harris says it cuts over “during carefully coordinated low-traffic periods.” Friday at 3 PM isn’t one.

Duffy described 2009

The weekend’s explanations line up with the 2009 findings almost word for word:

20262009 (OIG)
A contractor moving lines from copper to fiber, and a router in the switch “started flooding other routers” (Duffy)A router was replaced at Los Angeles Center during the move to new fiber, and its routing config was copied over from the old one
Routers giving “inconsistency in the data” (Duffy)The copied route map made the network “believe” traffic could go two different ways
“Over 1,000 connection attempts every four to five seconds” and routers “overloaded with data” (Duffy)Everything got funneled through Los Angeles to Salt Lake City, and the link “did not have the bandwidth.” The result was “over-utilized core routers”
“a network router problem, believed to have started at Chicago Midway” (CNN)The bad config was at one site, but the damage showed up all over the country: 129 facilities instead of 21
A “rolling frequency outage,” with Boston having trouble an hour before ChicagoA “domino effect” across the network
Mid-migration: 70% of sites moved from copper to fiber, with 2000s routers still in the pathMid-migration: moving from the legacy network to new fiber, with temporary routers bridging the two

My read, updated Saturday: one router at a cutover site hammered the network with connection attempts, 200 to 250 a second or more. That could be a login or tunnel storm, or neighbors dropping and reconnecting over and over. Either way, old routers starved of CPU stop talking to their neighbors, and the trouble spreads the way it did in 2009. The newer gear held. The DOT says it has installed 226 IP voice switches, and Duffy said the new switches stayed up. The 20-year-old routers and the TDM conversion boxes behind them fell out of sync, and the radar feeds, phone lines and radio links riding on them turned into static, flicker and gaps. That’s the failure the FAA described in its own 2015 paper. It also fits the timing above: several Centers went down within minutes of each other, which points at a shared layer of the network, not one site dragging down its neighbors. As for why this ran at 3 PM on a Friday, Duffy’s answer is that work at small remote sites happens during the day because “It shouldn’t have that kind of impact.” He added, “There’ll be a reevaluation of when we do this work.”

How it came back

Time (ET)What happened
8:00 PMCoastal facilities release some international departures
8:16 PMNational ground stop cancelled
8:15–8:23 PMGround delay programs cancelled at LaGuardia, Boston, Las Vegas, San Diego and San Francisco
8:23–10:15 PMCarrier-only ground stops for United (O’Hare, Newark), Alaska (Seattle, San Diego) and Delta (Minneapolis) as they dig out
OvernightFAA keeps its crisis hotlines open
Sat 7:42 AMThe FAA cancels the last emergency measure: extended flight-plan drop times at all 22 Centers, in place since 4:20 PM Friday “DUE TO NATIONWIDE COMMS FAILURE”
Sat 7:42–10:27 AMStill digging out: United ground-stops its own O’Hare arrivals for two and a half hours, and Delta does the same at LaGuardia from 9:00 to 10:27

Monitoring the situation

Boston Logan was “monitoring the situation and working with the FAA and our airline partners.” El Paso was “monitoring the situation” too. So was I. A cron job checked the FAA every 20 minutes:

23:28Z  no material change
23:49Z  CBS: update crashed it, L3Harris
00:09Z  CNN: router problem at Midway
00:28Z  no material change
00:47Z  no material change
01:07Z  no material change
01:27Z  no material change
01:47Z  GROUND STOP HAS BEEN CANCELLED

Sources

FAA Command Center advisories and NAS status, NWS text products, NOAA NEXRAD and TDWR on AWS, Orcas Airband, ADS-B history from adsb.lol (ODbL), RIPEstat, Nasdaq quotes, the DOT OIG and GAO reports, and the reporting linked above.